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DATA CENTERS AND THE CLOUD, PART II: 
THE FEDERAL GOVERNMENT’S TAKE ON 
OPTIMIZING NEW INFORMATION TECH- 
NOLOGIES OPPORTUNITIES TO SAVE TAX- 
PAYERS MONEY 


Thursday, July 25, 2013, 

House of Representatives, 

Subcommittee on Government Operations, 
Committee on Oversight and Government Reform, 

Washington, D.C. 

The subcommittee met, pursuant to call, at 9:34 a.m., in Room 
2154, Rayburn House Office Building, Hon. John Mica [chairman 
of the subcommittee] presiding. 

Present: Representatives Mica, Meadows, Connolly, and Pocan. 

Staff Present: Alexia Ardolina, Majority Assistant Clerk; Richard 
A. Beutel, Majority Senior Counsel; Caitlin Carroll, Majority Dep- 
uty Press Secretary; John Cuaderes, Majority Deputy Staff Direc- 
tor; Linda Good, Majority Chief Clerk; Tyler Grimm, Majority Pro- 
fessional Staff Member; Mark D. Marin, Majority Director of Over- 
sight; Sarah Vance, Majority Assistant Clerk; Jaron Bourke, Minor- 
ity Director of Administration; Adam Koshkin, Minority Research 
Assistant; Safiya Simmons, Minority Press Secretary; and Cecelia 
Thomas, Minority Counsel. 

Mr. Mica. Good morning. I would like to call this hearing of the 
Subcommittee on Government Operations to order. 

Welcome, everyone, this morning. The topic of today’s hearing is 
Data Centers in the Cloud, Part II: The Federal Government’s 
Take on Optimizing New Information Technologies and Opportuni- 
ties to Save Taxpayers Money. 

Mr. Issa usually gives a little statement of our mission, but that 
title almost sums it up. We are looking and have the responsibility 
to review various operations of the Federal Government and rep- 
resenting the taxpayers; looking for the most efficient, economical, 
and responsible means of carrying out the positions and conducting 
proper oversight of the agencies that perform those responsibilities. 

Today we have one panel and three witnesses. We welcome them. 
And our order of business will be as follows: we will start with 
opening statements by members and then we will proceed to hear 
from our three witnesses, and after that we will move to questions. 
We will hold the questions until we have heard from all of the pan- 
elists. 


( 1 ) 
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With that, I will recognize myself for an opening statement and 
then turn to our Democrat leader, the ranking member, Mr. 
Connolly, for his comments. 

I again have to state that our responsibility is that we look at 
what the various agencies are doing, in particular, some of this ac- 
tivity of our subcommittee may not be the flashy part of serving in 
Congress, with the hearings and all of the cameras and all of that, 
but, nonetheless, this is probably as important a responsibility as 
we have. This is the meat and potatoes, finding out where the 
money is being spent. 

On the particular program of IT, we spend a lot of money. It is 
estimated, I think, $84 billion annually. And we have had wit- 
nesses. This is our second hearing. Unfortunately, we didn’t have 
0MB and GSA representatives at the last hearing; I am glad they 
came this time. But because, again, of the sheer size and scope of 
this activity, the estimates, again, of potential savings are maybe 
as much as 50 percent of what we are currently saving. If we can 
consolidate, if we can use the mechanism of cloud computing, a 
whole host of efficiencies brought into this process, we have the po- 
tential for saving in a time when we are approaching a $17 trillion 
deficit. Substantial money. 

So I again welcome the witnesses. As we face this time of tight 
budgets, it has never been more important for the Federal Govern- 
ment to continue its efforts. 

Today’s hearing actually looks at, unfortunately, an attempt by 
the Administration, dates for several years now in trying to maxi- 
mize the return on investment and reduce the operational risk and 
provide responsive services to citizens through some IT consolida- 
tions. We, unfortunately, have found through our investigation that 
we don’t have a pretty good track record; that maybe the intent 
was good, but unfortunately what was set out as some goals and 
new approaches to achieve success, have not worked. 

We have two charts here that I want to point to, and they show, 
unfortunately, failed IT investments since 2003. The long and the 
short of it is we have lost about $9.2 billion in those failed at- 
tempts, a pretty significant amount. 

The second chart shows the number of troubled IT investments. 
That is enumerated on the chart that you see up on the screen. But 
this is startling: $102 billion is currently at risk from, again, a sim- 
ple evaluation information we have received. So this is quite trou- 
bling. 

While GAO had indicated initially that we had some I think it 
was 3,133 data centers, the most current data we have received 
says that that estimate is some now 7,145. So a pretty dramatic 
departure from what was originally estimated as the number of 
these non-core centers; and that totals 6,650. 

Unfortunately, since 2010 they have closed or consolidated 484 of 
these non-core centers. At the current rate, and that is over two 
years, while they estimate by the end of the year they will have 
855. But they plan, at least the plans we have been told, to close 
3,400, about half of the new estimate non-core. Unfortunately, if 
they keep it up at the pace that they have begun, it looks like it 
is almost impossible to achieve that goal. That is part of what we 
want to hear, how we are recalculating and how we plan to again 
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reach a significant goal, which was originally estimated, I think, at 
some $3 billion. The current calculations indicate that we will be 
at a $2.4 billion shortfall. 

Unfortunately, the duplications of common IT systems are pretty 
widespread, and GAO itself has reported that the Government 
funded 622 separate human resource systems at a cost of $2.4 bil- 
lion, 580 financial systems at a cost of $2.7 billion, and 777 supply 
chain systems at $3.3 billion; and the list continues. Many of these 
systems perform, unfortunately, the same function. 

0MB has the responsibility to oversee large IT projects, but often 
rolling out new and large management initiatives, when they do 
with great fanfare, unfortunately it doesn’t appear a lot is done to 
follow up or implement these programs; and we are going to look 
at one example, the Federal Data Center Consolidation Initiative, 
which was rolled out again in 2010. As I point out and predicted, 
they close a lot more of these centers, 40 percent of them, by 2015 
and save that $3 billion. The target is, again, very illusive from 
what we can see with the statistics and facts of accomplishment to 
date. 

So 0MB, unfortunately, has grossly underestimated the number 
of data centers. Now we have to deal with a much larger number 
than originally reported. Unfortunately, OMB’s savings to date are 
minimal, probably about $300 million, or 10 percent of the prom- 
ised $3 billion that had been promised. 

Unfortunately, we also find that 0MB is also skeptical about 
their own new process and how it will work. Its own testimony 
identifies deficiencies, and we will look at how that IT Dashboard 
hasn’t worked. We will also have to find out, firsthand today, how 
0MB plans to accelerate its use of key management initiatives and 
look at how, again, we are going to achieve these savings. So we 
want this to be a positive hearing; find out, again, what has gone 
wrong, and then see how we can correct it. 

We want to work with 0MB and GSA. Unfortunately, GSA, I 
found, has failed to develop or roll out its own critically needed new 
system to streamline the fashion by which contracting officers en- 
sure contracts are responsible vendors. That system, called SAM, 
System for Award Management, was completely restructured after 
multiple failures and millions of dollars wasted. 

And then, finally, what the GSA, I think they set a poor example 
themselves with over 109 core data centers. I am told they have 
only actually closed one to date. So we will want to get an update 
on where one of our principle agencies responsible for procurement 
and heavy involvement in the IT business has failed itself. 

So those are some opening commentaries. I have been picking up 
from Mr. Issa and also Mr. Connolly their efforts to try to get this 
to work better, be more effective, find ways to consolidate, find 
ways to streamline and provide the leadership to make that hap- 
pen. 

So let me yield now to Mr. Connolly, our ranking member. 

Mr. Connolly. Thank you, Mr. Chairman, and thank you and 
your staff for holding this second hearing on this subject. And I 
agree with you, this is the sexiest subject in town. Data center con- 
solidation, it is amazing the press just isn’t here in overflow, really. 
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But it actually is one of those building blocks, as you said, Mr. 
Chairman, of Government that is actually very important. 

First of all, I want to welcome our witnesses. I am glad they are 
here. Some of the things that have happened since our field hear- 
ing, one of which is Mr. VanRoekel is now at 0MB. So that, to me, 
is a heartening development because I think now we can better in- 
tegrate OMB’s management responsibilities with the goals we have 
here, rather than sort of as a set-aside nice thing to do. So inte- 
grating that into key management decision-making in the Execu- 
tive Branch I think is a real step forward. 

Mr. VanRoekel, congratulations on that new role. I know that is 
going to serve all of us well. 

From my point of view, and I certainly am open to testimony 
that would suggest otherwise, I share the chairman’s concern that 
we seem, when we are looking at metrics, and it isn’t just our opin- 
ion, it is the Government Accountability Office, we seem to be fall- 
ing behind. Good news: we have doubled the number of companies 
certified under FedRAMP since our field hearing, from three to six. 
But there are a lot of companies that would like to qualify and that 
would qualify but for a rather glacial pace of certification. We want 
to be thorough, but golly, gosh, darn, it seems to me we could do 
better. 

There are issues, as the chairman indicated, with the IT Dash- 
board. And in terms of data center consolidation, any way you 
measure it, we may be more accurate in defining what a data cen- 
ter is and, thus, the proliferation in numbers that might seem to 
suggest we are actually going in the wrong direction but in fact we 
are more accurate in trying to capture what is a data center, and 
that is good. But if you look at agency performance, agency by 
agency, essentially only four agencies are playing in the game, that 
is not acceptable. That is not acceptable. 

Finally, I would say to the Administration, and I guess Mr. 
VanRoekel, primarily through you as maybe the senior Administra- 
tion official here, but this committee, including the chairman, 
passed a bill, FATAR. It is the first comprehensive rewrite of Fed- 
eral IT acquisition in 20 years. It is designed to update and, in 
many ways, sort of replace Clinger-Cohen. It is the friendliest, 
most sympathetic bill you are going to get out of the Congress. It 
is, in large measure, a codification of, in fact, initiatives and re- 
forms undertaken by this Administration, mirabile dictu coming 
out of this Republican Congress. 

But if the Administration decides to spurn that legislation, that 
has passed the House already, I would just say to you you are 
going to have problems on both sides of the aisle. This represents, 
I think a real bipartisan effort. We work very hard to try to get 
this right. We tried to consult with the Administration. We con- 
sulted extensively with industry. 

The chairman, Mr. Issa, could have filed this bill back in Octo- 
ber. To his credit, to the staffs credit, they kept it open, negoti- 
ating with us, with industry, with the Administration, with others 
from October until we filed it finally late in February. And we were 
willing to take additional modifications to try to make sure we get 
it right. This is a bill designed to try to be helpful, to try to spur 
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the very reforms undertaken by this Administration, by Mr. 
VanRoekel and his predecessor. 

So I urge you to go back and consider support for this legislation. 
If there are changes, great, but a position of opposition is not going 
to sit well in this Congress on both sides of the aisle. So please con- 
sider it the helpful tool it was intended to be. We think that this 
is a subject matter that needs attention. And while it may not 
draw big crowds, as the chairman indicated, in terms of potential 
for savings, potential for the deployment of technology as a tool, an 
instrument for augmenting the decline in resources for so many 
agencies is profound; and we need you as a partner and we want 
to be a partner. 

So, with that, I look forward to the testimony, Mr. Chairman, 
and, as you know, I may have to sneak out to manage an amend- 
ment on the floor, but I will be back. And again I thank the chair 
for holding this hearing. 

Mr. Mica. Thank you, Mr. Connolly. 

Other members? Mr. Meadows? 

Mr. Meadows. Thank you, Mr. Chairman. I am just going to be 
very brief. 

Welcome. Thank you so much. The chairman has highlighted 
very accurately some of the concerns. I look forward to hearing 
your testimony today on how we can start to really make progress. 
As I read the report, I am very troubled that we continue to start 
and we restart and we start again, and yet the other part that we 
are not doing is, when we are looking at $3 billion in program 
goals, there is not really a measurable matrix on whether we are 
getting there or not. And it is very troubling when I sit there as 
a business guy and say, well, how do we know if we are making 
great progress when we are not even really accurately measuring 
it. 

I represent a district that has one of the greatest data centers 
in the world, Google. They know how to do it. And to find that we 
have 622 human resource systems out there, another 580 financial 
management systems, and 777 supply chain systems, many of 
which don’t talk to one another, one of the advantages of big gov- 
ernment should be the efficiencies of systems and the management 
thereof; and what we have done is we are acting like we are a pri- 
vate company with thousands of different systems that don’t work. 

So I look forward to hearing it. I know that we have a Leviathan 
here. I mean, this is a big problem. But the other aspect, it is very 
difficult for me to go back home and tell the people why we have 
wasted $10 billion on terminated projects; why we can’t figure it 
out on a lot of these before we spend the amount of money that we 
spend, before we make a determination it is not going to work. So 
I would be interested in hearing from each one of you the matrix 
of which we are going to be measuring it, the goals that we are 
going to do, and how we incentivize you to do that. 

The chairman has held a hearing on some 13,000 Federal build- 
ings, and we heard that the GAO really didn’t want to get rid of 
them because, if the money gets sold, it doesn’t go back to the 
GAO. I mean, I also am finding it amazing that we have most of 
our expenditures in the fourth quarter; that we have this dis- 
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proportionate amount of purchases that happens in the last quarter 
of every fiscal year. 

We all know what the problem is, but it really lacks account- 
ability. So I look forward to hearing from you on how we are going 
to measure it and how we are going to fix it going forward, and 
I thank the chairman. I yield back. 

Mr. Mica. I thank the gentleman. 

Other members? Mr. Pocan, welcome. 

If no other members seek recognition, we will turn to our panel 
of witnesses, and, again, we have three witnesses, and welcome 
them. 

First we have Mr. David Powner. He is the Director of Informa- 
tion Technology Management Issues for GAO, the Government Ac- 
countability Office; Mr. Steven VanRoekel. He is the Acting Deputy 
director for Management and Federal Chief Information Officer for 
the Office of Management and Budget; and Mr. David McClure is 
the Associate Administrator of the General Services Administra- 
tion’s Office of Citizen Services and Innovative Technologies. 

Welcome to the witnesses. 

This is an investigative and oversight committee of Congress 
and, in light of that, we do swear in our witnesses. If you will 
stand, raise your right hand. 

Do you solemnly swear or affirm that the testimony you are 
about to give before this subcommittee of Congress is the whole 
truth and nothing but the truth? 

[Witnesses respond in the affirmative.] 

Mr. Mica. Let the record reflect that the witnesses have re- 
sponded in the affirmative. 

So I welcome you and we will turn to our first witness. We will 
go to GAO first, Mr. David Powner. You are welcome and recog- 
nized. 

What we usually do is, it is a small panel today, but try to keep 
it to five minutes. Then we will go through the three of you and 
then come back for questions. 

So welcome again, Mr. Powner. You are recognized. 

STATEMENT OF DAVID POWNER 

Mr. Powner. Chairman Mica, Ranking Member Connolly, and 
members of the subcommittee, we appreciate the opportunity to 
testify on the Federal Government’s efforts to better manage its an- 
nual $80 billion investment in IT. My comments will focus on three 
areas: one, the Federal Government’s poor track record when it 
comes to delivering on large-scale IT acquisitions and the need for 
greater transparency and governance; two, the importance of the 
data center consolidation effort; and, three, the need to eliminate 
duplicative IT spending. 

Fortunately, for each of these three areas, poor delivery, unused 
data center capacity, and duplication, 0MB has excellent initia- 
tives in place. GAO’s work over the years has shown that the Gov- 
ernment has a poor track record when it comes to managing and 
delivering IT acquisitions. My written statement lays out a com- 
prehensive list of the many failed and troubled projects that are 
highlighted here. Specifically, 15 of these projects are examples 
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where billions of taxpayers’ dollars have been wasted, with little to 
show for it. 

To address this situation, 0MB rolled out the Federal IT Dash- 
board in 2009 to improve the transparency of approximately 700 
major IT investments, and since 2010 this information has been 
used to hold TechStat sessions to terminate and turn around IT in- 
vestments that are failing and not producing results. This in- 
creased transparency has resulted in improved governance, reduced 
scope, and even terminated projects. 

Clearly, the Dashboard and TechStat sessions have made a dif- 
ference, but this is not enough because some agencies are still not 
reporting Dashboard information accurately. In particular, DOD is 
reporting no red investments. We have highlighted DOD’s inac- 
curate reporting at multiple hearings and will continue to do so. 
When an agency is spending $34 of the $80 billion and not report- 
ing accurately, something needs to change to make sure our tax 
dollars are being appropriately overseen. Also, DOD has not up- 
dated most of their Dashboard CIO ratings for about two years. 

Regarding the TechState sessions, our work shows the number of 
TechStats held to date is relatively small compared to the currently 
reported 160 at-risk investments that total $10 million. 

So for troubled projects we need more accurate transparency on 
the Dashboard and even greater executive oversight. 

Turning to data centers. This consolidation effort was initiated to 
improve the Government’s low server utilization rates, which was 
estimated between 5 and 15 percent, far below the goal of 60 to 70 
percent; and this effort is to result in $3 billion in savings. Data 
center closures to date and those planned are promising. About 500 
centers have been closed and it is expected that over 800 will be 
closed by September. In addition, some agencies are already report- 
ing savings. The Department of Agriculture recently reported that 
it has saved $50 million this year, and DOD plans to save $575 
million in fiscal year 2014 alone. 

Our report recently delivered for this committee showed that 
0MB, GSA, and the Data Center Task Force need to step up efforts 
to track cost savings and to find metrics for those centers that re- 
main. In fact, 0MB has not been tracking cost savings. FATAR 
would be extremely helpful, since it requires the tracking and re- 
port of cost-savings and would ensure that this important initiative 
would span multiple administrations. 

Mr. Chairman, in addition to tracking cost-savings, there needs 
to be better transparency on how many centers are out there. 
When we testified before this subcommittee in May, we reported 
that there were about 3100 data centers Government- wide, only to 
learn from our audit work that the Government had 3,000 addi- 
tional centers. Last week, 0MB briefed congressional staff that 
there are actually 4,000 more centers, bringing the total to more 
than 7,000; and there are some fundamental questions whether the 
Government really knows what it has and why there isn’t better 
transparency here. Timely transparency on how many data centers 
are out there, closures, and cost-savings is needed. 

We also need to tackle duplication more aggressively. The Ad- 
ministration’s PortfolioStat process is an excellent initiative to ad- 
dress this duplication. 0MB states that the Portfolio results so far 
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have been significant and that agencies have identified nearly 100 
opportunities to consolidate or eliminate duplicative investments 
that is to result in savings of approximately $2.5 billion through 
2015. 

The latest PortfolioStat initiative is promising if carried out ef- 
fectively. However, I would like to make two specific observations 
regarding it: savings are much higher than $2.5 billion and are 
more in the $5 billion to $6 billion range; and, secondly, CIO au- 
thorities need to be strengthened at many agencies if CIOs are to 
carry this out. We are currently learning that not all CIOs have 
authority over commodity IT, which is not a very high bar. 

In summary, many of the initiatives over the past years have 
great promise; however, each requires more leadership from 0MB 
and agency CIOs so that billions of taxpayers’ dollars are not wast- 
ed. 

Chairman Mica, Ranking Member Connolly, this concludes my 
statement. I look forward to your questions. 

[Prepared statement of Mr. Powner follows:] 
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INFORMATION TECHNOLOGY 

OMB and Agencies Need to More Effectively 
Implement Major Initiatives to Save BiUions of 
Dollars 


What GAO Found 

GAO has issued a number of key reports on the federal government’s efforts to 
efficiently acquire and manage information technology (IT). White the Office of 
Management and Budget (OMB) and federal agencies have taken steps to 
address underperforming IT projects and more effectively manage IT through a 
number of major initiatives, additional actions are needed. For example, OMB 
has taken significant steps to enhance the oversight accountability of federal 
investments by creating the IT Dashboard, an OMB public website which 
provides detailed information on federal agencies' major investments. However, 
GAO previously found there were issues with the accuracy and reliability of cost 
and schedule data in the Dashboard and recommended steps that OMB and 
agencies should take to improve these data— this is important since the 
Dashboard currently reports 154 investments totaling almost $10.4 billion being 
at risk. OMB agreed with the recommendations. 

GAO recently reported that OMB and selected agencies have held multiple 
reviews — known as TechStats — of selected investments that are failing or are not 
producing results. Positive outcomes have been tracked and reported from these 
reviews, with most producing improved governance, as well as projects with 
accelerated delivery, reduced scope, and termination. However, for the selected 
agencies, GAO found that the number of at-risk TechStats held to date was only 
about 33 percent of the current number of medium- and high-risk investments. 
GAO was also unable to validate OMB's reported results of almost $4 billion in 
life-cycle cost savings. GAO therefore recommended that OMB validate the 
resulting cost savings and require agencies to conduct TechStats for each 
investment rated with a moderately high- or high-risk rating on the IT Dashboard. 
OMB generally agreed with the recommendations. 

GAO has also issued several reports on the federal government’s progress 
towards consolidating its growing number of data centers. Most recently, in April 
2013, GAO reported that agencies closed 420 data centers by the end of 
December 2012; however, OMB had not tracked and reported on other key 
performance measures, such as progress against the initiative’s cost savings 
goat of $3 billion by the end of 201 6. In addition, GAO identified weaknesses that 
existed in the oversight of the data center consolidation initiative, including not 
ensuring the completeness of agencies’ data center inventories and 
consolidation plans. GAO recommended that OMB track and report on key 
performance measures and improve the execution of important oversight 
responsibilities. OMB agreed with these recommendations. 

in March 2012, OMB launched PortfolioStat, which requires agencies to conduct 
annual reviews of its IT investments and make decisions on eliminating 
duplication, among other things. OMB believes this effort has the potential to 
save $2.5 billion over the next 3 years. OMB has since made significant changes 
to PortfolioStat in March 2013, including integrating it with its data center 
consolidation initiative and establishing new reporting requirements, However, 
GAO recently reported that OMB had not yet established revised data center 
metrics and goals for the combined initiative. GAO has ongoing wori< looking at 
PortfolioStat, including determining whether agencies are completing key actions. 


United States Government Accountability Office 


11 


Chairman Mica, Ranking Member Connolly, and Members of the 
Subcommittee: 

I am pleased to be here today to discuss the highlights and 
recommendations of our selected reports that focused on key aspects of 
the federal government's acquisition and management of information 
technology (IT) investments. As reported to the Office of Management 
and Budget (0MB), federal agencies plan to spend at least $82 billion on 
IT in fiscal year 2014. Given the scale of such planned outlays and the 
criticality of many of these systems to the health, economy, and security 
of the nation, it is important that 0MB and federal agencies provide 
appropriate oversight and transparency into these programs and avoid 
duplicative investments, whenever possible, to ensure the most efficient 
use of resources. 

As we have previously reported, federal IT projects too frequently incur 
cost overruns and schedule slippages while contributing little to mission- 
related outcomes.' During the past several years, we have issued 
multiple reports and testimonies on federal initiatives to acquire and 
improve the management of IT investments.® In those reports, we made 
numerous recommendations to federal agencies and OMB to further 
enhance the management and oversight of IT programs. 


’See. for example. GAO. fnfyrmation Technology: Better Informed Decision Making 
Needed on Navy's Next Generation Enterprise Network Acquisition, GAO-1 1 -1 60 
(Washington. D.C.: Mar 11. 2011); an(j Border Security: Preliminary Observations on the 
Status of Key Souffywest Border Technology Programs, GA0-11-448T (Washington. D.C.: 
Mar. 15. 2011). 

^See, for example, GAO, Information Technology: Additional Executive Review Sessions 
Needed to Address Troubled Projects. GAO-13-524 (Washington, D,C.: June 13, 2013); 
GAO, Data Center Consolidation: Strengthened Oversight Needed to Achieve Billions of 
Dollars in Savings. GAO-13-627T (Washington, D.C,: May 14, 2013); Data Center 
Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal. 
GAO-13-378 (Washington. D.C.: Apr. 23, 2013); Information Technology Dashboard: 
Opportunities Exist to Improve Transparency and Oversight of Investment Risk at Select 
Agencies, GAO-13-98 (Washington, D.C.: Oct. 16, 2012); Data Center Consolidation: 
Agencies Making Progress on Efforts, but Inventories and Plans Need to Be Completed, 
GAO-12-742 (Washington, D.C.; July 19, 20'\2y,lnformation Technology: Continued 
Attention Needed to Accurately Report Federal Spending and Improve Management, 
GAO-11-831T (Washington, D.C.: July 14. 2011); and Information Technology: Investment 
Oversight and Management Have Improved but Continued Attention Is Needed. 

GAO-1 1-454T (Washington, D.C.: Mar. 17. 2011). 
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As part of Its response to our prior work, 0MB deployed a public website 
in 2009, known as the IT Dashboard, which provides detailed information 
on federal agencies’ major IT Investments,^ including assessments of 
actual performance against cost and schedule targets (referred to as 
ratings) for approximately 700 major federal IT investments. In addition, 
0MB has initiated other significant efforts following the creation of the 
Dashboard. For example, 0MB began leading reviews — known as 
TechStat Accountability Sessions (TechStats) — of selected IT 
investments to Increase accountability and improve performance; 
launched an initiative to reduce the number of federal data centers (the 
Federal Data Center Consolidation Initiative (FDCCI)); and initiated 
PortfolioStat, which requires agencies to conduct annual reviews of their 
IT investments and make decisions on eliminating duplication. 

You asked us to testify on the results and recommendations from our 
selected reports that focused on key aspects of the federal government’s 
management of IT investments. Accordingly, my testimony specifically 
discusses our past work on OMB's IT Dashboard, TechStat reviews, IT 
acquisition best practices. FDCCI, and PortfolioStat, as well as failed and 
challenged IT projects.** My testimony also discusses ongoing follow-up 
work on our prior recommendations from these reports. All work on which 
this testimony is based was performed in accordance with generally 
accepted government auditing standards. Those standards require that 
we plan and perform the audit to obtain sufficient, appropriate evidence to 
provide a reasonable basis for our findings and conclusions based on our 
audit objectives. We believe that the evidence obtained provides a 


^According to 0MB guidance, a major IT Investment is a system or an acquisition 
requiring special management attention because it: has significant importance to the 
mission or function of the agency, a component of the agency, or another organization: is 
for financial mana^ment and obligates more than $500,000 annually; has significant 
program or policy implications; has high executive visibility; has high development, 
operating, or maintenance costs; is funded through other than direct appropriations; or is 
defined as major by the agency's capital planning and investment control process, 

‘See, tor example, GAO-13-524; GAO-13-378; GAO-13-9B; GAO-12-742; GAO, 
Information Technology: Critical Factors Underling Successful Major Acquisitions. 
GAO-12-7 (Washington, D.C.: Oct. 21, 2011); DOD Financial Management: 
Implementation Weaknesses in Army and Air Force Business Systems Could Jeopardize 
DOD's Auditability Goals. GAO-12-134 (Washington, D.C.: Feb. 28. 2012); Secure Border 
Initiative: DHS Needs to Strengthen Management and Oversight of Its Prime Contractor, 
GAO-11-6 (Washington, D.C.: Oct 18. 2010); and Polar-Orbiting Environmental Satellites: 
With Costs Increasing and Data Continuity at Risk, Improvements Needed in Tri-agency 
Decision Making. GAO-09-564 (Washington, D.C.: June 17, 2009). 
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reasonable basis for our findings and conclusions based on our audit 
objectives. 


Background 


Information technology should enable government to better serve the 
American people. Ho\wever. according to 0MB, despite spending more 
than $600 billion on IT over the past decade, the federal government has 
achieved little of the productivity improvements that private industry has 
realized from IT.® Too often, federal IT projects run over budget, behind 
schedule, or fail to deliver promised functionality. In combating this 
problem, proper oversight is critical. 

Both 0MB and federal agencies have key roles and responsibilities for 
overseeing IT investment management. 0MB is responsible for working 
with agencies to ensure investments are appropriately planned and 
justified. Additionally, each year, 0MB and federal agencies work 
together to determine how much the government plans to spend on IT 
projects and how these funds are to be allocated. 


Agencies Have Spent 
Billions on Failed and 
Poorly Performing 
Investments 


To assist agencies in managing their IT investments, Congress enacted 
the Clinger-Cohen Act of 1996, which requires 0MB to establish 
processes to analyze, track, and evaluate the risks and results of major 
capital investments in information systems made by federal agencies and 
report to Congress on the net program performance benefits achieved as 
a result of these investments.® Further, the act places responsibility for 
managing investments with the heads of agencies and establishes chief 
information officers (CIO) to advise and assist agency heads in carrying 
out this responsibility. 

Many of these investments are critical to our nation. For example, they 
include systems to secure our nation, control aircraft, and process tax 
returns. However, the federal government has spent billions of dollars on 
failed and poorly performing IT investments, as the following examples 
illustrate: 


®OMB, 25 Point Implomentation Plan to Reform Federal Information Technology 
Management (Washington, D.C.: December 2010), 

®40 U.S.C. § 11302(c). 
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• In December 2012, the Department of Defense (DOD) canceled the 
Air Force’s Expeditionary Combat Support System after having spent 
more than a billion dollars and missing multiple milestones, including 
failure to achieve deployment within 5 years of obligating funds. The 
system was to provide the Air Force with a single, integrated logistics 
system that was to control and account for about $36 billion of 
inventory. We issued several reports on this system and found that, 
among other things, the program was not fully following best practices 
for developing reliable schedules and cost estimates.^ Among other 
things, we had recommended that DOD ensure that any future system 
deficiencies identified through Independent assessments are resolved 
or mitigated prior to further deployment of the system. 

• In January 201 1 , the Department of Homeland Security ended the 
Secure Border Initiative Network (SBlnet) program after obligating 
more than $1 billion to the program because it did not meet cost- 
effectiveness and viability standards. Since 2007, we had identified a 
range of issues and made several recommendations to improve this 
program.® For example, in May 2010 we reported that the final 
acceptance of the first two deployments had slipped from November 
2009 to September 2010 and from March 2010 to November 2010, 
and that the cost-effectiveness of the system had not been justified.® 
As a result, we recommended that the department (1) limit near-term 
investment in the first incremental block of the program, (2) 
economically justify any longer-term investment in it, and (3) improve 
key program management disciplines. This work contributed to the 
department's decision to cancel the program. 


^GAO-1 2-1 34 and DOD Business Transformation: Improved Management Oversight of 
Business System Modernization Efforts Needed, GAO-11-53 (Washington, D.C.: Oct. 7, 
2010). 

®See, for example. GAO-1 1-^; GAO. Secure Border Initiative: DHS Needs to Reconsider 
Its Proposed Invesbnentin Key Technology Program, GAO-10-340 (Washington, D.C,: 
May 5, 201 0); Secure Border Initiative: DHS Needs to Address Testing and Performance 
Limitations That Place Key Technology Program at Risk, GAO-1 0-1 58 (Washington, D.C, : 
Jan. 29, 2010); Secure Border Initiative: DHS Needs to Address Signi^cant Risks in 
Delivering Key Tedinc^ogy Investment, GAO-08-1086 (Washington, D.C.; Sept, 22, 2008); 
and Secure Border Initiative: SBlnet Expenditure Plan Needs to Better Support Oversight 
and Accountability, GAO-07-309 (Washington, D,C,; Feb. 15, 2007). 

®GAO-10-340. 
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• In February 2010, a task force led by the President’s Office of Science 
and Technology Policy decided to disband the National Polar-orbiting 
Operational Environmental Satellite System (NPOESS), a weather 
satellite prr^ram managed by three different agencies, after having 
spent 16 years and almost $5 billion on the program. We issued a 
series of reports on the NPOESS program that highlighted the 
technical challenges, cost growth, and tri-agency management 
challenges facing the program,^® For example, in June 2009 we 
reported that the program’s approved cost and schedule baselines 
were not achievable, and that costs could grow by approximately $1 
billion over the then-current $13.95 billion estimate.” We further noted 
that schedules for the launch of a demonstration satellite and the first 
two operational satellites were expected to be delayed, increasing the 
risk of a gap in satellite continuity. However, after the program’s 
cancellation, the agencies were directed to undertake separate 
acquisitions. 

Appendix I provides furfiier details on federal IT projects that have failed 
or faced significant challenges. 

In addition to these projects, the IT Dashboard identifies other at-risk 
investments. Specifically, as of July 2013, according to the IT Dashboard, 
154 of the federal government's approximately 700 major IT 
investments— totaling about $10.4 billion— were in need of management 
attention (rated to indicate the need for attention or to indicate significant 
concerns). (See fig. 1 .) 


^“^See. for example. GAO-09-564; GAO, Environmental Satellites: Polar-orbiting Satellite 
Acquisition Faces Delays; Decisions Needed on Whedier and How to Ensure Climate 
Data Continuity, GAO-08-51 8 (Washington, D C.: May 16, 2006); Polar-orbiting 
Operational Environmental Satellites: Restructuring Is Under Way, but Technical 
Challenges and Flisks Remain. GAO-07-498 (Washington, D.C.: Apr. 27. 2007); and 
Polar-orbiting Envircmmental Stellites: Information on Program Cost and Schedule 
Changes. GAO'04-1054 (Washington, D.C.: Sept. 30, 2004). 

'’GAO-09-564. 
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Figure 1: Overall Perfonnance Ratings of Major inves^ents on the IT Dashboard, 
as of July 2013 



Federal IT Spending Is in addition to poorly performing investments, federal IT spending is 
Burdened with Inefficient hampered by inefficient operations and duplication, as the following 
Operations and 

Duplication , Federal data centers. In March 201 1 , we reported that the increasing 

demand for IT had led to a dramatic rise in the number of federal data 
centers, with many housing similar types of equipment and providing 
similar processing and storage capabilities.’’^ As federal agencies 
have modernized their operations, put more of their services online, 
and increased their information security profiles, they have demanded 


’^GAO, Opportunities to Reduce Potential Duplication in Government F^grams, Save 
Tax Dollars, and Enhance Revenue, GAO-11-318SP {Washington. D.C,: Mar. 1, 2011), 
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more computing power and data storage resources. According to 
0MB, the number of federal data centers grew from 432 in 1 998 to 
more than 2,000 In 2010. The growth in the number of federal data 
centers, many offering similar services and resources, has resulted in 
overlap and duplication among the centers. In addition, according to 
0MB, in August 2009 the average utilization rate for servers ranged 
from 5 percent to 15 percent. In contrast. OMB’s 2012 Data Center 
Consolidation Plan guidance states that the target for server utilization 
is 60 to 70 percent. 

Duplicative IT investments. In September 201 1 , we reported that 
limitations in OMB’s guidance hindered efforts to identify IT 
duplication.'*^ Specifically, although OMB’s guidance to federal 
agencies on how to categorize IT investments allowed for analysis of 
Investments with similar functions, it did not go far enough to allow 
identification of potentially duplicative investments. Specifically, since 
the fiscal year 2004 budget cycle, 0MB had required agencies to 
categorize their IT investments according to primary function and 
subfunction. In their fiscal year 201 1 submissions, agencies reported 
the greatest number of IT investments In Information and Technology 
Management (1 ,536 investments), followed by Supply Chain 
Management (777 Investments), and Human Resource Management 
(622 investments). Similarly, planned expenditures on investments 
were greatest in Information and Technology Management, at about 
$35.5 billion. Figure 2 depicts, by primary function, the total number of 
investments within the 26 federal agencies that report to the IT 
Dashboard, as of July 2011. 


^^GAO. Information Technr^ogy: 0MB Needs to Improve Its Guidance on IT Investments, 
GAO-1 1-826 (Washington. D.C.: Sept. 29, 201 1 ). 
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Figure 2: Number of Government IT Investments by Primary Function, as of July 2011 
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Source: GAO analysis of exhiM 53 dala. 


However, we noted that categorizing IT investments according to 
primary function and subfunction limited OMB’s ability to identify 
potentially duplicative investments both within and across agencies 
because similar Investments may be organized under different 
functions. Accordingly, we recommended that 0MB revise guidance 
to federal agencies on categorizing IT investments to ensure that the 
categorizations are clear and that It allows agencies to choose 
secondary categories, where applicable, 0MB generally agreed with 
this recommendation and has since taken action to implement it. 
Specifically, 0MB updated its policy to enable agencies to select one 
primary category and up to four secondary categories for each IT 
investment. 


We also reported that results of 0MB initiatives to identify potentially 
duplicative investments were mixed and that several federal agencies 
did not routinely assess their entire IT portfolios to identify and remove 
or consolidate duplicative systems. Specifically, we said that most of 
OMB’s recent initiatives had not yet demonstrated results, and several 
agencies did not routinely assess legacy systems to determine if they 
are duplicative. As a result, we recommended that 0MB require 
federal agencies to report the steps they take to ensure that their IT 
investments are not duplicative as part of their annual budget and IT 
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investment submissions. 0MB generally agreed with this 
recommendation and has since taken action to implement it. 
Specifically, in March 2012, 0MB issued a memorandum to federal 
agencies regarding implementing PortfolioStat reviews. As previously 
mentioned, these reviews are intended to assist in ending the 
investment in duplicative IT investments. In addition, as part of this 
effort, 0MB is requiring agencies to document their cost savings and 
cost avoidance due to consolidation beginning in their fiscal year 2014 
budget submissions. 


0MB Has Launched Major OMB has implemented a series of initiatives to improve the oversight of 
Initiatives for Overseeing underperforming investments, more effectively manage IT, and address 

IT Investments duplicative investments. These efforts include the following; 

• IT Dashboard. Given the importance of transparency, oversight, and 
management of the government’s IT investments. In June 2009 OMB 
established a public website, referred to as the IT Dashboard, that 
provides detailed information on approximately 700 major IT 
investments at 27 federal agencies, Including ratings of their 
performance against cost and schedule targets. The public 
dissemination of this information is intended to allow OMB; other 
oversight bodies, Including Congress: and the general public to hold 
agencies accountable for results and performance. 

• TechStat reviews. In January 2010, the Federal CIO began leading 
TechStats sessions — face-to-face meetings to terminate or 
turnaround IT investments that are failing or are not producing results. 
These meetings involve OMB and agency leadership and are 
intended to increase accountability and transparency and improve 
performance. Subsequently. OMB empowered agency CIOs to hold 
their own TechStat sessions within their respective agencies. 
According to the former Federal CIO, the efforts of OMB and federal 
agencies to improve management and oversight of IT investments 
have resulted in almost $4 billion in savings, 

• FDCCi. Concerned about the growing number of federal data centers, 
in February 2010 the Federal CIO established FDCCi. This initiative’s 
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four high-level goals are to promote the use of “green by 
reducing the overall energy and real estate footprint of government 
data centers; reduce the cost of data center hardware, software, and 
operations; increase ttie overall IT security posture of the government: 
and shift IT investments to more efficient computing platforms and 
technologies. 0MB believes that this initiative has the potential to 
provide about $3 billion In savings by the end of 2015. 

• PortfolioStat In order to eliminate duplication, move to shared 
services, and improve portfolio management processes, in March 
2012 0MB launched the PortfolioStat initiative. Specifically, 
PortfolioStat requires agencies to conduct an annual agency-wide IT 
portfolio review to, among other things, reduce commodity \V^ 
spending and demonstrate how their IT investments align with the 
agency’s mission and business functions.''® PortfolioStat is designed 
to assist agencies In assessing the current maturity of their IT 
investment management process, making decisions on eliminating 
duplicative investments, and moving to shared solutions in order to 
maximize the return on IT investments across the portfolio. 0MB 
believes that the PortfolioStat effort has the potential to save the 
government $2.5 billion over the next 3 years by, for example, 
consolidating dupiicative systems. 


^"“Green IT refers to environmentally sound computing practices that can include a 
variety of efforts, su<^ as using energy efficient data centers, purchasing computers that 
meet certain environmental standards, and recycling obsolete electronics. 

"'^According to 0MB, commodity IT indudes services such as IT infrastructure (data 
centers, netwoil^s, desktop computers and mobile devices); enterprise IT systems (e-mail, 
collaboration tools, identity and access management, security, and web infrastructure); 
and business systems (finance, human resources, and other administrative functions). 

Implementing Portf(^ioStat, Memorandum. M-12-10 (Washington D.C.; Mar. 30, 

2012 ). 
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0MB and Agencies 
Have Taken Steps to 
Improve the 
Acquisition and 
Management of IT 
Investments, but 
Additional Actions 
Are Needed 


Over the past several years, we have highlighted 0MB and agency efforts 
to improve the transparency Into and oversight of underperforming federal 
IT Investments, more effectively manage IT, and address duplicative 
investments. Notably, we issued a series of reports on: the IT Dashboard; 
0MB and agency efforts to address troubled projects through TechStat 
reviews: ca“itlcal factors underlying successful acquisitions; and 0MB and 
agency efforts to improve the management of IT through federal data 
center consolidation efforts, as well as address duplication through 
PortfolioStat. 

0MB Launched the IT Dashboard to Increase Oversight and 
Transparency, but Improvements Needed 


0MB has taken significant steps to enhance the oversight, transparency, 
and accountability of federal IT investments by creating its IT Dashboard, 
and by improving the accuracy of investment ratings. However, we found 
weaknesses with the accuracy and reliability of cost and schedule data, 
and we recommended steps that 0MB should take to improve these data. 


Our July 2010 report’^ found that the cost and schedule ratings on 
OMB’s Dashboard were not always accurate for the investments we 
reviewed, because these ratings did not take into consideration 
current performance. As a result, the ratings were based on outdated 
information. We recommended that 0MB report on its planned 
changes to the Dashboard to improve the accuracy of performance 
information and provide guidance to agencies to standardize 
milestone reporting. 0MB agreed with our recommendations and, as 
a result, updated the Dashboard’s cost and schedule calculations to 
include both ongoing and completed activities. Similarly, in March 
201 1 , 0MB had Initiated several efforts to increase the Dashboard’s 
value as an oversight tool, and had used its data to improve federal IT 
management.^® However, agency practices and the Dashboard’s 
calculations contributed to inaccuracies in the reported investment 
performance data. These included, for instance, missing data 
submissions or erroneous data at each of the five agencies we 


^^GAO, Information Technology: OMB's Dashboard Has Increased Transparency and 
Oversight, but Improvements Needed, GAO-10-701 (Washington, D C.: July 16, 2010). 

^®GAO. Information Technology: 0MB Has Made Improvements to Its Dashboard, but 
Further Worif Is Needed by Agencies and 0MB to Ensure Data Accuracy, GAO-1 1-262 
(Washington, D.C.: Mar. 15. 2011). 
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reviewed, along instances of inconsistent program baselines and 
unreliable source data. As a result, we recommended that the 
agencies take steps to improve the accuracy and reliability of their 
Dashboard information, and that 0MB improve how it rates 
investments relative to current performance and schedule variance. 
Most agencies generally concurred with our recommendations; 0MB 
agreed with our recommendation for improving ratings for schedule 
variance. It disagreed with our recommendation to improve how it 
reflects current performance in cost and schedule ratings, but more 
recently made changes to Dashboard calculations to address this 
while also noting challenges in comprehensively evaluating cost and 
schedule data for these investments. 

• Our subsequent report in 201 1 noted that that the accuracy of 
investment cost and schedule ratings had improved since our July 
2010 report because 0MB had refined the Dashboard’s cost and 
schedule calculations. Most of the ratings for the eight investments we 
reviewed were accurate, although more could be done to inform 
oversight and decision making by emphasizing recent performance in 
the ratings. We recommended that the General Services 
Administration comply with OMB’s guidance for updating its ratings 
when new information becomes available (including when 
investments are rebaseiined) and the agency concurred. Since we 
previously recommended that 0MB improve how It rates investments, 
we did not make any further recommendations. 

• More recently, in October 2012 we found that opportunities existed to 
improve transparency and oversight of investment risk at our selected 
agencies.^® Specifically, CIOs at six federal agencies consistently 
rated the majority of their IT investments as low risk. These agencies 
rated no more than 12 percent of their investments as high or 
moderately high risk, and two agencies (DOD and the National 
Science Foundation) rated no investments at these risk levels. Over 
time, about 47 percent of the agencies’ Dashboard Investments 
received the same rating in every rating period. For ratings that 
changed, the Department of Homeland Security and Office of 
Personnel Management reported more investments with reduced risk 


''^GAO. IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way to 
Better Inform Decision Making, GAO-12-210 (Washington, D.C.; Nov. 7, 2011). 

2°GA0-13-98. 
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when initial ratings were compared with those in March 2012; the 
other four agencies reported more investments with increased risk. In 
the past, 0MB reported trends for risky IT investments needing 
management attention as part of the President’s annual budget 
submission, but discontinued this reporting In fiscal year 2010. 
Accordingly, we recommended 0MB analyze agencies’ investment 
risk overtime as reflected in the Dashboard’s CIO ratings and present 
Its analysis \Mth the President's annua! budget submission, with which 
0MB concurred. 

Further, agencies generally followed OMB’s instructions for assigning 
CIO ratings, which included considering stakeholder input, updating 
ratings when new data become available, and applying OMB’s six 
evaluation factors. DOD’s ratings were unique in reflecting additional 
considerations, such as the likelihood of OMB review, and 
consequently DOD did not rate any of its investments as high risk. 
However, in selected cases, these ratings did not appropriately reflect 
significant cost, schedule, and performance issues reported by GAO 
and others. Although three DOD Investments experienced significant 
performance problems and were part of a GAO high-risk area 
(business systems modernization), they were all rated low risk or 
moderately low risk by the DOD CIO. For example, in early 2012, we 
reported that Air Force’s Defense Enterprise Accounting and 
Management System faced a 2-year deployment delay and an 
estimated cost increase of about $500 million from an original life- 
cycle cost estimate of $1 . 1 billion (an increase of approximately 45 
percent), and that assessments by DOD users had identified 
operational problems with the system, such as data accuracy issues, 
an inability to generate auditable financial reports, and the need for 
manual workarounds.^’ In July 2012, the DOD Inspector General 
reported that the system's schedule delays were likely to diminish the 
cost savings it was to provide, and would jeopardize the department’s 
goals for attaining an auditable financial statement. DOD’s CIO rated 
the Defense Enterprise Accounting and Management System low risk 
or moderately low risk from July 2009 through March 201 2. 

Moreover. DOD did not apply its own risk management guidance to 
the ratings, which reduces their value for investment management 


^’GAO, DOD Financial Management: Reported Status of Department of Defense's 
Enterprise Resource Planning Systems, GAO-12-565R (Washington, D.C.: Mar. 30, 2012) 
and GAO-12-134. 
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and oversight. Therefore, we recommended that DOD ensure that its 
CIO ratings reflect available investment performance assessments 
and its risk management guidance. DOD concurred with our 
recommendation. 

Additional TechStat Reviews Needed to Address Troubled Projects 

Regarding TechStat reviews, we reported that 0MB and selected 
agencies had held multiple TechStats, but additional 0MB oversight was 
needed to ensure that these meetings were having the appropriate impact 
on underperforming projects and that resulting cost savings were valid. 
Specifically, we reported that as of April 201 3, 0MB reported conducting 
79 TechStats, which focused on 55 investments at 23 federal agencies. 
Further, 4 selected agencies — the Departments of Agriculture, 

Commerce, Health and Human Services, and Homeland Security — 
conducted 37 TechStats covering 28 investments. About 70 percent of 
the OMB-led and 76 percent of agency-ied TechStats on major 
investments were considered medium to high risk at the time of the 
TechStat. However, the number of at-risk TechStats held to date was 
relatively small compared to the current number of medium- and high-risk 
IT investments. Specifically, the OMB-led TechStats represented roughly 
18.5 percent of the investments across the government that had a 
medium- or high-risk CIO rating. For the 4 selected agencies, the number 
of TechStats represented about 33 percent of the investments that have a 
medium- or high-risk CIO rating. We concluded that until 0MB and 
agencies develop plans to address these weaknesses, the investments 
would likely remain at risk. 

In addition, we reported that OMB and selected agencies had tracked and 
reported positive results from TechStats, with most resulting in improved 
governance. Agencies also reported projects with accelerated delivery, 
reduced scope, or termination. We also found that OMB reported in 201 1 
that federal agencies achieved almost $4 billion in life-cycle cost savings 
as a result of TechStat sessions. However, we were unable to validate 
OMB’s reported results because OMB did not provide artifacts showing 
that it ensured the results were valid. From our selected agencies, three 
investments had cost implications. Agencies provided supporting 
documentation for about $22.2 million in cost savings and avoidances. 

We concluded that until OMB obtains and shares information on the 


22GAO-1 3-524. 
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methods used to validate reported results, it would be difficult for the 
results to be independently validated and for 0MB to provide assurance 
to Congress and the public that TechStats were achieving their intended 
impact. We therefore recommended that 0MB validate the resulting cost 
savings from TechStats that it reports to Congress and require agencies 
to conduct TechStats for each IT investment rated with a moderately 
high- or high-risk CIO rating on the IT Dashboard. We also made 
recommendations to the selected agencies to strengthen their TechStat 
processes. 0MB and the Department of Commerce officials generally 
agreed with our recommendations. The Department of Agriculture 
partially agreed with our assessment; neither it nor the Department of 
Health and Human Services commented on the recommendations. 

Critical Factors Underlying Successful Major Acquisitions 

Subsequent to the launch of the Dashboard and the TechStat reviews, 
and to help the federal agencies address the well-documented acquisition 
challenges they face, we identified seven successful investment 
acquisitions and nine common factors critical to their success in 2011.^® 
Specifically, we reported that department officials identified seven 
successful investment acquisitions, in that they best achieved their 
respective cost, schedule, scope, and performance goais.^'* In addition, 
common factors critical to the success of three or more of the seven 
investments were; (1) program officials were actively engaged with 
stakeholders: (2) program staff had the necessary knowledge and skills; 
(3) senior department and agency executives supported the programs; (4) 
end users and stakeholders were involved in the development of 
requirements: (5) end users participated in testing of system functionality 
prior to formal end user acceptance testing; (6) government and 
contractor staff were stable and consistent; (7) program staff prioritized 
requirements; (8) program officials maintained regular communication 
with the prime contractor; and (9) programs received sufficient funding. 
Further, officials from all seven investments cited active engagement with 


23GAO-12-7. 

seven invesbnents were (1) Commerce's Decennial Response integration System, 
(2) DOD's Defense Global C<xnbat Support System-Joint (Increment 7), (3) Department of 
Energy's Manufacturing Operations Management Project, (4) DHS's Western Hemisphere 
Travel Initiative, (5) Department of Transportation's Integrate Terminal Weather System. 
(6) Internal Revenue Service's Customer Account Data Engine 2, and (7) Veterans Affairs 
Occupational Health Record-keeping System. 
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program stakeholders as a critical factor to the success of those 
investments. These critical factors support OMB’s objective of improving 
the management of large-scale IT acquisitions across the federal 
government, and wide dissemination of these factors could complement 
OMB’s efforts. 

Strengthened Oversight Needed to Consolidate Federal Data 
Centers and Achieve Cost Savings 

In an effort to consolidate the growing number of federal data centers, in 
2010, 0MB launched the FDCCI. As part of this initiative, agencies 
developed plans to consolidate data centers; however, these plans were 
incomplete and did not include best practices. In addition, although 
agencies had made progress on their data center closures, OMB had not 
determined initiative-wide cost savings, and oversight of the initiative was 
not being performed in all key areas. Finally, as part of ongoing follow-up 
work, we determined that agencies closed additional data centers, but 
that the number of federal data centers was significantly higher than 
previously estimated by OMB. 

• In July 201 1 , we issued a report on the status of FDCCI and found 
that only 1 of the 24 agencies had submitted a complete inventory and 
no agency had submitted complete plans.^® Further, OMB had not 
required agencies to document the steps they had taken, if any. to 
verify the inventory data. We concluded that until these inventories 
and plans were complete, agencies would not be able to Implement 
their consolidation activities and realize expected cost savings. 
Moreover, without an understanding of the validity of agencies’ 
consolidation data. OMB could not be assured that agencies were 
providing a sound baseline for estimating consolidation savings and 
measuring progress against those goals. Accordingly, we made 
several recommendations to OMB, including that the Federal CIO 
require that agencies, when updating their data center inventory, state 
what actions were taken to verify the information in the inventory and 
to identify any associated limitations on the data, and to complete the 
missing elements in their Inventories and consolidation plans. OMB 
generally agreed with our report and has since taken actions to 
address our recommendations. For example, in July 201 1 , OMB 


^®GAO, Data Center Consolidation: Agencies Need to Complete Inventories and Plans to 
Achieve Expected Savings. GAO-11-565 (Washington. D.C,: July 19, 2011). 
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required agency CIOs to submit a letter that identified steps taken to 
verify their data center inventory information and attest to the 
completeness of their consolidation plan. In addition, in March 2012, 
0MB required that all agencies, by the end of the fourth quarter of 
every fiscal year, complete all elements missing from their 
consolidation plans. 

Additionally, in July 2012, we updated our review of FDCCI’s status 
and found that, while agencies’ 201 1 inventories and plans had 
improved as compared to their 2010 submissions, only 3 agencies 
had submitted a complete inventory and only 1 agency had submitted 
a complete consolidation plan.^® In addition, we noted that 3 agencies 
had submitted their inventory using an outdated format, in part, 
because 0MB had not publicly posted its revised guidance. 
Notwithstanding these weaknesses, we found that 19 agencies 
reported anticipating about $2.4 billion in cost savings between 201 1 
and 2015. 

We also reported that none of five selected agencies had a master 
program schedule or cost-benefit analysis that was fully consistent 
with best practices. To assist agencies with their data center 
consolidation efforts, 0MB had sponsored the development of a 
FDCCI total cost of ownership^^ mode! that was intended to help 
agencies refine their estimated costs for consolidation: however, 
agencies were not required to use the cost model as part of their cost 
estimating efforts. Accordingly, we reiterated our prior 
recommendation that agencies complete missing plan and inventory 
elements and made new recommendations to 0MB to publically post 
guidance updates on the FDCCI website and to require agencies to 
use its cost model. 0MB generally agreed with our recommendations 
and has since taken steps to address them. More specifically, 0MB 
posted Its 2012 guidance for updating data center Inventories and 
plans, as well as guidance for reporting consolidation progress, to the 
FDCCI public website. Further, the website has been updated to 
provide prior guidance documents and 0MB memoranda. In addition, 
OMB’s 2012 consolidation plan guidance required agencies to use the 
cost model as they developed their 2014 budget request. 


2®GA0-12-742. 

^^OMB refers to total cost of ownership as all associated data-center-related activities and 
coste without regard to owner^ip, project association, or funding line. 
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• More recently, we reported^® and testified®' that the 24 FDCCi 

agencies made progress towards OMB’s goal to close 40 percent, or 
1,253 of the 3,133 total federal data centers, by the end of 2015, but 
0MB had not measured agencies’ progress against its other goal of 
$3 billion in cost savings by the end of 2015. Agencies closed 420 
data centers by the end of December 2012 and had plans to close an 
additional 548 to reach 968 by December 201 5 — 285 closures short of 
OMB’s goal. 0MB had not determined agencies' progress against its 
cost savings goal because, according to 0MB staff, the agency has 
not determined a consistent and repeatable method for tracking cost 
savings. We reported that this lack of information makes it uncertain 
whether the $3 billion in savings is achievable by the end of 2015. We 
concluded that until 0MB tracks and reports on performance 
measures such as cost savings, it will be limited in its ability to 
oversee agencies’ progress against key goals. 

Further, we reported that, pursuant to 0MB direction, three 
organizations — the Data Center Consolidation Task Force," the 
General Services Administration Program Management Office, and 
0MB — are responsible for federal data center consolidation oversight 
activities. We found that while most activities were being performed, 
there were still several weaknesses in oversight. For example, while 
the General Services Administration's Program Management Office 
had collected agencies' quarterly data center closure updates and 
made the information publically available on an electronic dashboard 
for tracking consolidation progress, it had not fully performed other 
oversight activities, such as conducting analyses of agencies' 
inventories and plans. In addition, while 0MB had implemented 
several initiatives to track agencies' consolidation progress, such as 
establishing requirements for agencies to update their plans and 
inventories yearly and to report quarterly on their consolidation 
progress, the agency had not approved the plans on the basis of their 
completeness or reported on progress against its goal of $3 billion in 


"GAO-13-378. 

"GAO-13-627T. 

"The Data Center Consolidation Task Force is comprised of the data center consolidation 
program managers from each agency. According to its charter, the Task Force is critical to 
supporting cxtllaboration across the FDCCI agencies, including identifying and 
disseminating key pieces of information, solutions, and processes that wil) help agencies 
in their consolidation eft)rts. 
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cost savings. The weaknesses in oversight of the data center 
consolidation initiative were due, in part, to 0MB not ensuring that 
assigned responsibilities are being executed. We concluded that 
improved oversight could better position 0MB to assess progress 
against its cost savings goal and minimize agencies’ risk of not 
realizing expected cost savings. 

We therefore recommended that OMB’s Federal CIO track and report 
on key performance measures, extend the time frame for achieving 
planned cost savings, and improve the execution of important 
oversight responsibilities. 0MB agreed with two of our 
recommendations and stated that it plans to evaluate the remaining 
recommendation related to extending the time frame. 

• Finally, as part of ongoing foliow-up work, we reported that agencies 
had closed an additional 64 data centers compared to the total 
number of reported closures through the end of December 2012. 

More specifically, as of May 201 3, agencies had reported closing 484 
data centers by the end of April 2013, and were planning to close an 
additional 571 data centers — for a total of 1,055— by September 2014. 
However, we also found that the number of federal data centers had 
grown significantly since 0MB had reported in December 201 1 that 
there were approximately 3,133 data centers. Specifically, as of July 
2013, 22 of the 24 FDCCI agencies had collectively reported 6,836 
data centers in their inventories,®^ which is approximately 3,700 data 
centers more than OMB’s previous estimate from December 201 1 

0MB Launched PortfolioStat to Address Duplicative Investments 

To address duplicative IT investments, 0MB launched PortfolioStat in 
March 2012, which is designed to assist agencies in assessing the 
current maturity of their IT portfolio management process, making 
decisions on eliminating duplication, and moving to shared services in 
order to maximize the return on IT Investments across the portfolio. 


®^Two agencies had not yet provided updated inventories — ^the Sociat Security 
Administration and the Department of Veterans Affairs. 

®®Deparlment of Agriculture officials stated that, in December 2012, the deparffnent added 
approximately 2,200 data centers to its inventory to account for its county office locations 
that each have one IT server. 
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We recently reported^^ and testified^ on OMB’s PortfolioStat initiative, 
including that, in March 2013, 0MB issued a memorandum documenting 
additional guidance to help strengthen the initiative. In its memorandum, 
0MB noted that the results from PortfolioStat so far had been 
significant — including that agencies had identified and committed to 
nearly 100 opportunities to consolidate or eliminate commodity IT 
investments and also described plans to strengthen the initiative by 
integrating PortfolioStat and FDCCI, streamlining agency reporting 
requirements, and establishing guidance for conducting PortfolioStat 
sessions in fiscal year 2013. For example, to improve the outcomes of 
PortfolioStat and to advance agency IT portfolio management, OMB’s 
memorandum consolidated previously collected IT plans, reports, and 
data calls into three primary collection channels — an information 
resources management strategic plan,^® an enterprise road map,^’’ and an 
integrated data collection channel.^® Agencies’ draft versions of their 
strategic plans and enterprise road maps were due to 0MB in May 2013, 
as well as their first integrated data collections. The integrated data 
collections are to be updated quarterly beginning in August 2013 and the 
strategic plans and road maps are to be updated after Congress receives 
the President’s budget for fiscal year 201 5. 


®^GAO-1 3-378- 

®^GAO, Information Technology: 0MB and Agencies Need to Focus Continued Attention 
on Eliminating Duplicative Investments, GAO-13-685T {Washington, D.C.: June 11, 2013) 
and GAO-1 3-627T. 

Fiscal Year 2013 PortfolioStat Guidance: Strengthening Federal IT Porthlio 
Management. Memorandum M-13-09 {Washington, D.C.: Mar. 27, 2013). 

®®OMB, Management of Federal Information Resources, Circular A-130 {Washington, 

D C.: Nov. 30, 2000). According to 0MB Circular A-130, an agency’s information 
resources management strategic plan should describe how information resources 
management activities help accomplish agency missions, and ensure that information 
resource management decisions are integrated with organizational planning, budget, 
procurement, financial management, human resources management, and program 
decisions, 

®^OMB, Increasing Shared Approaches to Information Technology Services {Washington, 
D C.; May 2, 2012). The enterprise road map is to indude a business and technology 
architTCfure, an IT asset inventory, a commodity IT consolidation plan, a line of business 
service plan, and an IT shared service plan. 

®®The integrated data collection channel will be used by agencies to report stmctured 
information, such as progress in meeting IT sfrategic goals, idsjectives, and metrics, as 
well as cost savings and avoidances resulting from IT management actions. 
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However, our April 2013 report noted that key data-center-reiated 
performance metrics of the combined initiative were not yet fully defined. 
For example, OMB's March 2013 memorandum^® stated that, to more 
effectively measure the efficiency of an agency’s data center assets, 
agencies would also be measured by the extent to which their data 
centers are optimized for total cost of ownership by incorporating metrics 
for data center energy, facility, labor, and storage, among other things. 
Although 0MB had indicated which performance measures it planned to 
use going forward, it had not documented the specific metrics for 
agencies to report against. OMB’s March 2013 memorandum indicates 
that these would be developed by the Data Center Consolidation Task 
Force, but did not provide a time frame for when this will be completed. 

Further, our report noted that OMB’s integration of FDCCl with 
PortfotioStat also Included a modification to the previous data center 
consolidation goal of closing approximately 40 percent of the total number 
of agency data centers. Specifically, 0MB stated an agency's data center 
population wrill now be placed into one of two categories — core and non- 
core data centers — but for which the memorandum did not provide 
specific definitions. 0MB further stated that its new goal is to close 40 
percent of non-core data centers but, as noted, the definitions of core and 
non-core data centers were not provided. Therefore, the total number of 
data centers to be closed under OMB’s revised goal could not be 
determined. 

We also reported that, although OMB had previously stated that 
PortfotioStat was expected to result in savings of approximately $2.5 
billion through 2015, its March 2013 memorandum did not establish a 
new cost savings goal that reflected the integration of FDCCl. Instead, 
OMB stated that all cost savings goals previously associated with FDCCl 
would be integrated into broader agency efforts to reshape their IT 
portfolios, but did not provide a revised savings estimate. We concluded 
that the lack of a new cost savings goal would limit OMB’s ability to 
determine wrfiether or not the new combined initiative is on course toward 
achieving its planned objectives. As a result, we recommended that OMB 
track and annually report on key data center consolidation performance 
measures, such as the size of data centers being closed and cost savings 
to date. OMB agreed with our recommendation. 


Memorandum M-13-09. 
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We have ongoing work looking at OMB’s PortfolioStat initiative, including 
determining whether agencies completed key required PortfolioStat 
actions, evaluating selected agencies’ plans for making portfolio 
improvements and achieving associated cost savings, and describing 
OMB's plans to improve the PortfolioStat process. 


in summary, OMB’s and agencies’ recent efforts have resulted in greater 
transparency and oversight of federal spending, but continued leadership 
and attention are necessary to build on the progress that has been made. 
For example, federal agencies need to continue to improve the accuracy 
of information on the Dashboard to provide greater transparency and 
even more attention to the billions of dollars invested in troubled projects. 
Further, additional TechStat reviews are needed to focus management 
attention on additional troubled projects and establish clear action items 
to turn the projects around or terminate them, in addition, the expanded 
use of the common factors critical to the successful management of large- 
scale IT acquisitions should result in the more effective delivery of 
mission-critical systems. 

The federal government can also build on the momentum of progress on 
agencies’ data center closures as the federal data center consolidation 
effort is integrated with PortfolioStat. 0MB recently released additional 
guidance that expanded this important initiative's scope and reported that 
significant progress had been made to date, including more than 100 
opportunities to consolidate or eliminate commodity IT investments. 
Moving forward, it will be important for 0MB to be transparent on 
agencies' progress against key performance metrics, such as data center 
consolidation cost savings, In order to ensure that the PortfolioStat 
initiative is meeting its established objectives. Overall, the implementation 
of GAO recommendations can help further reduce wasteful spending on 
poorly managed, unnecessary, and duplicative investments. 


Chairman Mica, Ranking Member Connolly, and Members of the 
Subcommittee, this completes my prepared statement. I would be 
pleased to respond to any questions that you may have at this time. 
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Appendix I: Examples of IT Project Failures 
and Challenges 


The federal government continues to spend billions of dollars on troubled 
IT investments. This appendix identifies examples of major IT 
investments that have failed or faced significant challenges. In this 
regard, we focused on IT projects that were considered major 
development or acquisition efforts, based on their size or mission 
criticality. We considered a project to have failed if it was terminated by 
the agency after substantial investment and without delivering significant 
planned capabilities. A project was considered to be challenged if we had 
identified significant issues in its performance or management and made 
recommendations for improvement. To identify these projects, we 
reviewed our work published since January 1 , 2003, that addressed the 
performance or management of federal agency IT projects. We did not 
include a project on our lists if it was not the subject of a GAO report. 


Pailpri Tnvprstmpntt; Since 2003, a number of major IT projects at federal agencies have 

failed. Specifically, agencies canceled the following investments after 

spending millions of dollars: 

• Department of Defense’s (DOD) Expeditionary Combat Support 
System (ECSS) 

• DOD's Defense Integrated Military Human Resources System 
(DIMHRS) 

• Department of Homeland Security's (DHS) Computer-Assisted 
Passenger Prescreening System (CAPPS II) 

• DHS's Electronically Managing Enterprise Resources for Government 
Effectiveness and Efficiency {eMerge2) 

• DHS’s Next Generation Homeland Security Information Network 
(HSIN Next Gen) 

• DHS's Secure Border Initiative Network (SBinef) 

• Federal Bureau of Investigation's (FBI) Virtual Case File (VCF) 

• General Services Administration's (GSA) e-Authentication Program 

• National Archives and Records Administration's (NARA) Electronic 
Records Archive (ERA) 

• National Polar-orbiting Operational Environmental Satellite System 
(NPOESS) 

• Office of Personnel Management's (0PM) Retirement Systems 
Modernization 

• Veterans Affairs’ (VA) Scheduling Replacement Project 

. VA’s Core Financial and Logistics System (CoreFLS) 

• VA’s Financial and Logistics Integrated Technology Enterprise 
(FLITE) Program 


Page 24 


GAO-1 3-796T 



35 


Appendix i: Exanpi^ of IT Project Failures 
and Challenges 


• VA’s Health Information Systems and Technology Architecture — 
Foundations Modernization (VistA-FM) 

These projects were canceled after going over budget, missing schedule 
milestones, or failing to deliver intended capabilities. In many of these 
cases, we had identified issues in the management of these programs 
and made recommendations for improvement. These issues were often 
related to a lack of disciplined and effective management, such as project 
planning, requirements definition, and program oversight and 
governance. The following provides additional information on these failed 
IT investments. 

DOD’s Expeditionary Combat Support System (ECSS) 

In December 2012, DOD canceled ECSS after having spent more than a 
billion dollars and missing multiple milestones, including failure to achieve 
deployment within 5 years of obligating funds. The system was to provide 
the Air Force with a single, integrated logistics system that was to control 
and account for about $36 billion of inventory. We issued several reports 
on this system and found that, among other things, the program was not 
fully following best practices for developing reliable schedules and cost 
estimates."' Among other things, we had recommended that DOD ensure 
that any future system deficiencies identified through independent 
assessments be resolved or mitigated prior to further deployment of 
ECSS. 

OOD’s Defense integrated Military Human Resources System 
(DIMHRS) 

in February 2010, DIMHRS was canceled after 10 years of development 
and approximately $850 million spent, due, in part, to a lack of strategic 
alignment, governance, and requirements management, as well as the 
overall size and scope of the effort.^ The system was intended to provide 


^GAO, DOD Business Transfoimation: Improved Management Oversight of Business 
System Modernization Efforts Needed, GAO-1 1-53 (Washington, D.C.; Oct. 7, 2010) and 
DOD Financial Management: Implementation Weaknesses in Army and Air Force 
Business Systems Could Jeopardize DOD's Auditability Goals, GAO-12-134 (Washington, 
D C.: Feb. 28, 2012). 

^GAO, information Technology: Departments of Defense and Energy Need to Address 
Potentially Duplicative Investments. GAO-12-241 (Washington, D C,: Feb, 17, 2012). 
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Appendix t: Examples of IT Project Failures 
and Challenges 


a joint, integrated, standardized personnel and pay system for all military 
personnel. In 2008, we had reported that Army officials had concerns 
about the extent to which Army requirements were being incorporated 
into DIMHRS and that DOD had not established a clear, well-defined 
process for maintaining effective communications to better prepare the 
Army to deploy DIMHRS.® We had recommended that DOD develop a 
clearly defined process for effectively communicating the differences 
between DIMHRS's capabilities and the Army’s requirements. However, 
subsequent to the cancellation decision, each military service is now 
responsible for developing its own integrated personnel and pay system. 

DHS’s Computer-Assisted Passenger Prescreening System (CAPPS 

H) 

In August 2004, DHS canceled its CAPPS II program — a Transportation 
Security Administration (TSA) initiative to develop a system to identify 
passengers requiring additional security attention — due to a variety of 
delays and challenges. In February 2004, we reported that, according to 
program officials, approximately $41.5 million had been allocated for the 
system’s acquisition to date and that the program faced a number of 
implementation challenges.'* Specifically, key activities in the development 
of CAPPS II had been delayed, and TSA had not completed important 
system planning activities. In addition, TSA had not completely addressed 
seven of the eight issues identified by Congress as key areas of Interest 
related to the development, operation, and public acceptance of CAPPS 
II. We also identified other challenges, including developing the 
international cooperation needed to obtain passenger data, managing the 
possible expansion of the program’s mission beyond its original purpose, 
and ensuring that identity theft could not be used to negate the security 
benefits of the system. We recommended, among other things, that DHS 
develop project plans, including schedules and estimated costs, to guide 
development; establish a plan for completing critical security activities; 
and develop a process by which passengers can get erroneous 
information corrected. CAPPS II was eventually replaced by the Secure 


®GAO. DOD Systems Modernization: Maintaining Effective Communication Is Needed to 
Help Ensure the Army's Successful Deplo^ent of the Defense Integrated Military Human 
Resources System, GAO-08-927R (Washington, D.C.: Sept. 8. 2008). 

*GAO, Aviation Security: Corrymter-Assisted Passenger Prescreening System Faces 
Significant Implementation Challenges. GAO-04-385 (Washington. D.C.: Feb. 12, 2004). 
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and Challenges 


Flight system, which in turn was completely revamped and replaced by a 
new version of Secure Flight that finally became operational. 

DHS’s Electronically Managing Enterprise Resources for 
Government Effectiveness and Efficiency (eMerge^) 

DHS canceled its eMerge^ project in December 2005 after an 
unsuccessful pilot program that began in January 2004 and lasted about 
2 years. The project was expected to integrate financial management 
systems across the entire department and address financial management 
weaknesses. According to DHS, it had spent a total of about $52 million 
for the eMerge^ project, including approximately $18 million in contractor 
costs. As we reported in June 2007, DHS officials stated that several of 
the work products developed for eMerge^ would be useful as they move 
forward with their financial management modernization efforts, regardless 
of the strategic financial management direction ultimately selected by the 
department.^ However, we found that key work products were of limited 
value. Specifically, the concept of operations did not contain an adequate 
description of the legacy systems and a clear articulation of the vision that 
should guide the department’s improvement efforts, and key requirements 
developed for the project were unclear and incomplete. We 
recommended, among other things, that, going forward, DHS employ best 
practices in defining its financial management system strategy, such as 
developing a comprehensive concept of operations document, 
standardizing business processes, and using disciplined processes to 
minimize project risk. 

DHS’s Next Generation Homeland Security information Network 
(HSIN Next Gen) 

In October 2010, DHS terminated the acquisition of Its HSIN Next Gen 
system, which was to be the follow-on to its original HSIN system, the 
department’s primary IT system for sharing terrorism-related information. 
The department cited, among other things, continuing cost, schedule, and 
performance shortfalls and the lack of key IT management controls and 
capabilities that are essential to mitigating such shortfalls and ensuring 
successful system delivery. In 2008 we reported that DHS had yet to 


®GAO, Homeland Security: Departmentwide Integrated Financial Management Systems 
Remain a Challenge, GAO-07-536 (Washington, D.C.; June 21, 2007). 
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implement tiie full set of controls essential to effectively manage the 
acquisition of HSIN Next Gen ® We recommended that DHS strengthen its 
acquisition management controls before it started to implement the 
system. The termination of HSIN Next Gen resulted in a cost reduction of 
$128,969,000- 

DHS’s Secure Border initiative Network (SBlnet) 

In January 2011, the Secretary of Homeland Security ended the SBlnet 
program after obligating more than $1 billion to the program because it 
did not meet cost-effectiveness and viability standards. Since 2007, we 
had identified a range of Issues and made several recommendations to 
improve this program.’^ For example, in May 2010 we reported that the 
final acceptance of the first two deployments had slipped from November 
2009 to September 2010 and from March 2010 to November 2010, and 
that the cost-effectiveness of the system had not been justified.® We 
concluded that DHS had not demonstrated that the considerable time and 
money being invested to acquire and deploy the program was a wise and 
prudent use of limited resources. As a result, we recommended that the 
department (1) limit near-term investment in the first incremental block of 
the program, (2) economically justify any longer-term investment in it. and 
(3) improve key program management disciplines. This work contributed 
to the department’s decision to cancel the program. 


®GAO, Inkirmation Technology: Management Improvements Needed on the Department 
of Homeland Security's Next Generation Information Sharing System, GAO-09-40 
(Washington, D.C.: Oct. 8, 2008). 

^See. for example, GAO, Secure Border Initiative: DHS Needs to Strengthen Management 
and Oversight of Its Prime Contractor, GAO-11-6 (Washington, D.C.: Oct. 18, 2010); 
Secure Border Initiative: DHS Needs to Reconsider Its Proposed Investment in Key 
Technology Program, GAO-10-340 (Washington, D.C.: May 5. 2010); Secure Border 
Initiative: DHS Needs to Address Testing and Performance Limitations That Place Key 
Technology Program at Risk. GAO-10-158 (Washington. D.C.: Jan. 29. 2010); Secure 
Border Initiative: DHS Needs to Address Significant Risks in Delivering Key Technology 
Investment, GAO-08-1086 (Washington, D.C.: Sept. 22, 2008); and Secure Border 
Initiative: SBlnet Expenditure Plan Needs to Better Support Oversight and Accountability, 
GAO-07-309 (Washington. D.C.; Feb. 15. 2007). 

“GAO-10-340. 
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FBI’S Virtual Case File (VCF) 

In March 2005, the FBI discontinued the VCF component of its Trilogy 
project after investing 3 years and $170 million. The FBI terminated the 
project after Trilogy’s overall projected costs grew from $380 million to 
$537 million, the program fell behind schedule, and pilot testing showed 
that completion of VCF was infeasible and cost prohibitive. Among 
reasons we and others cited for VCF’s failure were poorly defined system 
requirements, ineffective requirements change control, limited contractor 
oversight, and human capital shortfalls due to, for example, a lack of 
continuity in certain management positions and a lack of trained staff for 
key program positions.® 

GSA’s e-Authentication Program 

In October 2003, it was reported that GSA had terminated plans to 
develop an “e-Authentication gateway,” which was to provide a 
consolidated electronic authentication service to support the e- 
government initiatives sponsored by 0MB. We had reported 1 month 
earlier in September 2003 that, according to agency officials, 1 3 agencies 
had provided a total of $13.5 million to GSA for the gateway as of August 
18. 2003, with another $3 million expected from another agency by the 
end of fiscal year 2003.’° However, GSA had achieved few of Its project 
objectives and extended the milestone for completing a fully operational 
system. We noted that the modest progress that had been achieved to 
date called into question the likelihood that the project could successfully 
field an operational gateway, even within the revised schedule. Further, 
the project faced a number of challenges, including developing 
procedures and guidance defining the specific technologies to support 
different authentication requirements, agreeing upon technical standards 
to provide a basis for ensuring interoperability, and taking full measures to 


°GAO. Information Technology: FBI Following a Number of Key Acquisition Practices on 
New Case Management System, but Improvements Still Needed, GAO-07-912 
(Washington, D.C.; July 30. 2007); Information Technology: FBI Has Largely Staffed Key 
Modernization Program, but Strategic Approach to Managing Program's Human Capital Is 
Needed, GAO-07-19 (Washington, D.C.: Oct. 16. 2006); and Information Technology: FBI 
Is Building Management Capabilities Essenhal to Successful System Deployments, but 
Challenges Remain, GAO-05-1014T (Washington, D.C.; Sept. 14. 2006), 

’°GAO. Electronic Government Planned e-Authentication Gateway Faces Formidable 
Development Challenges. GAO-03-952 (Washington, D.C.; Sept, 12, 2003), 
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ensure that the gateway system was adequately secured and that privacy 
information adequately protected. 

NARA’s Electronic Records Archive (ERA) 

In July 2010, 0MB directed NARA to halt development of its ERA system 
at the end of fiscal year 201 1 (a year earlier than planned). 0MB cited 
concerns about the system’s cost, schedule, and performance and 
directed NARA to better define system functionality and improve strategic 
planning. Through fiscal year 2010, NARA had spent about $375 million 
on the system. We issued several reports and made recommendations to 
improve this system, noting, among other things, that NARA’s plans for 
ERA lacked sufficient detail to clearly show what functions had been 
delivered or were to be included in future increments and at what cost; 
the agency had been inconsistent in its use of earned value management 
to monitor the project's progress: and NARA lacked a contingency plan 
for ERA to ensure system continuity in the event that normal operations 
were disrupted."” These findings and recommendations contributed to the 
decision to halt the system. 

National Polar-orbiting Operational Environmental Satellite System 
(NPOESS) 

In February 2010, a presidential task force decided to disband NPOESS 
after having spent 16 years and almost $5 billion on the program. 
NPOESS was a tri-agency weather satellite program managed by the 
National Oceanic and Atmospheric Administration (NOAA), DOD, and the 
National Aeronautics and Space Administration (NASA). We issued a 
series of reports on the NPOESS program that highlighted the technical 
challenges, cost grovrth, and tri-agency management challenges facing 


^^See, for example, GAO, Electronic Records Archive: Status Update on the National 
Archives and Records Administration's Fiscal Year 2010 Expenditure Plan, GAO-1 0-657 
(Washington. D.C.; June 11, 2010); Electronic Recoixis Archive: The National Archives 
and Records Administration's Fiscal Year 2009 Expenditure Plan. GAO-09-733 
(Washington, D.C.; July 24, 2009); and National Archives: Progress and Risks in 
lmplementir}g its Electronic Records Archive Initiative, GAO-10-222T (Washington, D.C.: 
Nov. 5, 2009). 
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the program. For example, in June 2009 we reported that the program’s 
approved cost and schedule baselines were not achievable, and that 
costs could grow by approximately $1 billion over the then-current $13.95 
billion estimate.''® We further noted that schedules for the launch of a 
demonsfration satellite and the first two operational satellites were 
expected to be delayed, increasing the risk of a gap in satellite continuity. 
We had also found that the NPOESS program’s tri-agency executive 
council was Ineffective, and we made recommendations aimed at 
improving ttiis executive-level oversight. However, after the program's 
cancellation, the agencies were directed to undertake separate 
acquisitions. 

OPM’s Retirement Systems Modernization 

In February 2011, 0PM canceled its Retirement Systems Modernization 
program after several years of trying to improve the implementation of this 
investment.’^ This was the agency’s third major effort over a more than 
20-year period to automate the processing of federal employee retirement 
claims. According to 0PM, It spent appro)dmateiy $231 million on this 
investment. We issued a series of reports on the agency’s efforts to 
modernize its retirement system and found that the agency was hindered 
by weaknesses in several important management disciplines that are 


''^See, for example, GAO, Polar-Orbiting Environmental Satellites: With Costs Incraasing 
and Data Continuity at Risk, Improvements Needed in Tri-agency Decision Making, 
GAO-09-564 (Washington. D C.: June 17, 2009); Environmental Satellites: Polar-orbiting 
Satellite Acquisition Faces Delays; Decisions Needed on \Myetherand How to Ensure 
Climate Data Continuity. GAO-OS-SIS (Washington. D.C.: May 16, 2008); Polar-orbiting 
Operational Environmental Satellites: Restructuring Is Under Way, but Technical 
Challenges and Risks Remain, GAO-07-498 (Washington, D C.: Apr. 27, 2007); and 
Polar-orbiting Environmental Satellites: Information on Program Cost and Schedule 
Changes, GAO-04-1054 (Washington, D.C.; Sept, 30, 2004). 

^®GAO, Polar-Orbiting Environmental Satellites: With Costs Increasing and Data 
Continuity at Risk. Improvements Needed in Tri-agency Decision Making, GAO-09-564 
(Washington. D.C.; June 17, 2009). 

^'‘GAO, OPM Retirement Modernization: Longstanding Information Technology 
Management Weaknesses Need to Be Addressed, GAO-12-226T (Washington, D.C.; 
Nov. 15. 2011). 
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essential to successful IT modernization efforts.^® Accordingly, we made 
recommendations in areas such as project management, organizational 
change management, testing, cost estimating, and earned value 
management. In May 2008, an 0PM official cited the issues that we 
identified as justification for issuing a stop work order to the system 
contractor, and the agency subsequently terminated the contract, which 
resulted in a cost reduction of $136.5 million between fiscal years 2009 
and 2013. 

VA’s Scheduling Replacement Project 

In September 2009, VA terminated its Scheduling Replacement Project, 
after spending an estimated $127 million over 9 years. The investment 
was to modernize its more than 25-year>old outpatient scheduling system, 
but the department had not yet implemented any of the planned system’s 
capabilities. VA began a new initiative that it refers to as HealtheVet 
Scheduling on October 1, 2009. In May 2010, we reported that VA’s 
efforts to successfully complete the Scheduling Replacement Project 
were hindered by weaknesses in several key project management 
disciplines and a lack of elfective oversight that, if not addressed, could 
undermine the department’s second effort to replace Its scheduling 
system. As the department proceeded with future development, we 
recommended that it take actions to improve key processes, including 
acquisition management, system testing, and progress reporting, which 
are essential to the department’s second outpatient scheduling system 
effort. 

VA’s Core Financial and Logistics System (CoreFLS) 

VA’s first attempt to develop an integrated financial and asset 
management system, CoreFLS, began in 1998 but was discontinued by 
the department In 2004 because the pilot system failed to support VA's 


^®GAO. Office of Personnel Management: Retirement Modernization Planning and 
Management Shortcomings Need to Be Addressed. GAO-09-529 (Washington, D.C.: Apr. 
21, 2009); Office of Personnel Management: Improvements Needed to Ensure Successful 
Retirement Systems Modernization, GAO-08-345 (Washington, D.C.: Jan. 31, 2008); 
Comments on ffie Office of Personnel Management's February 20, 2008 Report to 
Congress Regarding the Retirement Systems Modernization, GAO-08-576R (Washington, 
D.C.: Mar, 28, 2008); and Office of Personnel Management: Retirement Systems 
Modernization Program Faces Numerous Challenges, GAO-05*237 (Washington, D.C.: 
Feb, 28. 2005). 
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operations after the deparftnent reportedly spent more than $249 million 
on development. The department conducted three independent 
assessments of the initiative that collectively identified 141 findings, which 
the department categorized into functional areas of responsibility such as 
acquisition management, organizational change management, program 
management, and systems engineering. VA aggregated these findings 
into a repository of lessons learned to inform future efforts. However, we 
reported in September 2008 that the department had not taken corrective 
actions to address all the findings, and recommended that it do so.''® 
Subsequently, VA officials provided documentation showing that all items 
in the repository had been addressed. 

VA’s Financial and Logistics integrated Technoiogy Enterprise 
(FLITE) Program 

In October 201 1 . VA terminated its FLITE program, an effort to deliver an 
integrated financial and asset management system for the department. 
Begun in 2005, the system was intended to be delivered by 2014 at a 
total estimated cost of $608.7 million but was canceled due to challenges 
in managing the program, including an unsuccessful pilot of the Strategic 
Asset Management system. The FLITE program was VA’s second effort 
to develop such a system. We had reported in October 2009 that the 
department had not yet fully established capabilities needed to ensure 
that the program will be successfully implemented and recommended that 
it take steps to improve program management."*’ 

VA’s Health Information Systems and Technology Architecture — 
Foundations Modernization (VistA*FM) 

in October 2010, VA terminated its VistA-FM program, which was to 
address the need to transition the VA electronic medical record system to 
a new architecture. As we reported in October 2009, the program, which 
had been estimated to cost $1.9 billion, had significant weaknesses in its 
earned value management processes, and we estimated that the 


’®GAO. Veterans Affairs: Additional Details Are Needed in Key Planning Documents to 
Guide the New FinarKial and Logistics Initiative, GAO'08'1097 (Washington, D C.; Sept. 
22. 2008). 

^’GAO, Information Technology: Acticms Needed to Fully Establish Program Management 
Capability for VA’s Finand^ and Logistics Initiative, GAO-10-40 (Washington, D C.: Oct. 
26. 2009). 
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program would likely overrun its budget at completion by about $350.2 
million.''® As a result of our recommendations and an internal department 
evaluation of the program, multiple components of the program were 
suspended, before the program was finally terminated in 2010. 


Challenged IT 
Investments 


In addition to canceling many failed projects, the government has 

continued to invest in challenged IT projects. The following are selected 

examples of such Investments that have faced significant challenges: 

• Department of Commerce/Census Bureau’s 2010 Decennial Census 

• Department of Commerce/NOAA’s Geostationary Operational 
Environmental Satellite-R (GOES-R) Series 

• DHS’s Rescue 21 Program 

• DHS’s United States Visitor and Immigrant Status Indicator 
Technology (US-VISIT) Program 

• DOD's Armed Forces Health Longitudinal Technology Application 
(AHLTA) 

• DOD’s Defense Enterprise Accounting and Management System 
(DEAMS) 

• DOD's Global Combat Support System-Army (GCSS-Army) 

• DOD’s Global Combat Support System-Marine Corps (GCSS-MC) 

• DOD’s Navy Enterprise Resource Planning System (Navy ERP) 

• DOD’s Navy Next Generation Enterprise Network (NGEN) 

• DOD/Department of the Treasury’s Navy Cash Program 

• DODA/A’s Integrated Electronic Health Record (iEHR) 

• DODA/A's Federal Health Care Center (FHCC) 

• Food and Drug Administration’s (FDA) Mission Accomplishments and 
Regulatory Compliance Services (MARCS) 

• Internal Revenue Service’s (IRS) Customer Account Data Engine 
(CADE) 

• NASA’s James Webb Space Telescope (JWST) 

• U.S. Department of Agriculture's (USDA) Modernize and Innovate the 
Delivery of Agricultural Systems (MIDAS) Program 

We have identified challenges facing these projects, many due to 

ineffective or undisciplined management, and have made 


^®GAO, Information Technology: Agencies Need to Improve the Implementation and Use 
of Earned Value Techniques to Help Manage Major System Acquisitions, GAO-10-2 
(Washington, D C.: Oct 8, 2009). 
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recommendations for improvement. The following provides additional 
information on these challenged IT investments. 

Department of Commerce/Census Bureau’s Decennial Census 

At a cost of about $13 billion, the 2010 Decennial Census was the 
costliest in history. This was due. in part, to cost overruns and major 
performance problems with key IT systems. For example, the Census 
Bureau’s Field Data Collection Automation (FDCA) program, originally 
estimated to cost $596 million, was intended to use handheld mobile 
devices to support field data collection for the census, including in-person 
follow-up with those who did not return their census questionnaires 
(nonresponse follow-up). However, we testified in March 2008 that the 
program was experiencing significant problems, including schedule 
delays and cost increases from changes in requirements.’® We had 
previously reported that the FDCA project office had not implemented the 
full set of acquisition management capabilities that were needed to 
effectively manage the program and that the changes to requirements 
had been a contributing fector to both schedule delays and cost increases 
experienced by the FDCA program. 

In April 2008, due to problems identified during testing and cost overruns 
and schedule slippages, the Secretary of Commerce announced a 
redesign of the 2010 Census, resulting in a $205 million increase in life- 
cycle costs. Also in April 2008, the Census Bureau decided not to use the 
handheld devices for nonresponse follow-up. but did continue to use the 
devices for other decennial census operations. Dropping the use of 
handhelds for nonresponse follow-up and replacing them vwth a paper- 
based system increased the cost of the Census by up to $3 billion. 
Although the bureau worked aggressively to improve the paper-based 
system that replaced the handheld computers, we reported in December 
201 0 that the paper-based system also experienced significant issues 
when it was put in operation.^® For example, performance problems with 
the IT system used to manage the nonresponse follow-up process led to 


’®GAO, Infomation Technology: Significant Problems of Critical Automation Program 
Contribute to Risks Facing 2010 Census, GAO-08-550T (Washington, D.C.: Mar. 5, 2008). 

^°GAO, 2010 Census: Data Collection Operations Were Generally Completed As 
Planned, but Long-Standing Challenges Suggest Need for Fundamental Reforms, 
GAO-11-193 (Washington. D C.: Dec, 14, 2010), 
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processing backl<^s, which hindered the bureau’s ability to fully 
implement quality assurance procedures as planned. We recommended, 
accordingly, that the bureau incorporate best practices in its IT acquisition 
management policy. In September 2012, we reported that the Census 
Bureau still needed to implement key IT management practices to select, 
control, and evaluate its IT investments and effectively manage system 
development, as well as key practices for effective workforce planning, 
and recommended it take eight actions to do so.^^ Until such steps are 
taken, the bureau faces the risk that the same kind of IT management 
and implementation challenges that faced the 2010 Decennial Census will 
Impact the 2020 Census. 

Department of Commerce/NOAA’s Geostationary Operational 
Environmental Sateilite-R (GOES-R) Series 

The Department of Commerce’s NOAA, with the aid of NASA, is to 
procure the next generation of geostationary operational environmental 
satellites — a series of four satellites intended to replace existing weather 
satellites that will likely reach the end of their useful lives in about 2015. 
This new series is considered critical to the United States’ ability to 
maintain the continuity of data required for weather forecasting. NOAA 
estimates that the GOES-R series will cost $10.9 billion through 2036; the 
launch of the first satellite is planned for October 2015. In September 
2010, we reported that, since 2006, the launch dates of the first two 
satellites in the series have been delayed by about 3 years, which could 
lead to a gap in coverage if the existing weather satellites fail 
prematurely.^^ We also found that NOAA had not established adequate 
continuity plans in the event of a satellite failure with no backup available 
and that the agency had not adequately involved users at federal 
agencies that rely on GOES data in developing and prioritizing 
requirements. We recommended that NOAA address weaknesses in its 
continuity plans and improve its processes for involving other federal 
agencies. Subsequently, NOAA established a continuity plan for GOES-R 


^^GAO. Information Tochnology: Census Bureau Needs to Implement Key Management 
Practices. GAO-12-915 (Vyashington, D.C.; Sept. 18, 2012). 

^^GAO, Geostationary Operational Environmental Satellites: Improvements Needed in 
Continuity Planning and Involvement of Key Users, GAO-10-799 (Washington, D.C,: Sept- 
1 , 2010 ). 
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and developed a communications plan for involving agencies that depend 
on GOES data. 

In June 2012 we reported that technical problems with instruments and 
spacecraft, among others, had delayed key reviews and led to increased 
complexity for the development of GOES-R.^^ While the program reported 
having $1 .2 billion in reserve to manage future delays and cost growth, 
significant development remained, and we concluded that the program 
may not be able to ensure that it has adequate resources to cover 
ongoing challenges and unexpected problems, in addition, we found that 
the program’s schedule contained deficiencies, and it had not fully 
implemented risk management best practices. We recommended that 
NOAA assess and report reserves needed over the life of the program 
and address the issues with its schedules and risk management. NOAA 
reported that it would take steps to implement these recommendations. 

DHS’s Rescue 21 Program 

DHS's Rescue 21 program is intended to modernize the U.S. Coast 
Guard's maritime search and rescue communications capability. Since 
2003, we have reported on significant weaknesses in the oversight and 
management of the program, including continued cost growth and 
schedule delays.^** For example, in May 2006, we found that the 
estimated total acquisition cost for Rescue 21 had increased from $250 
million in 1999 to $710.5 million in 2005, and the time line for achieving 
full operating capability had been delayed from 2006 until 201 1 We 
recommended that executive-level management oversee Rescue 21’s 
progress toward cost and schedule milestones and manage risks; 
establish milestones to complete an integrated baseline review; and 


^^GAO, Geostationary Weather Satellites: Design Progress Made, but Schedule 
Uncertainty Needs to be Addressed. GAO-12‘576 (Washington, D C,: June 26, 2012). 

^'‘GAO, Information Technology Cost Estimation: Agencies Need to Address Significant 
Weaknesses in Policies and practices, GAO-12-629 (Washington, D C.: July 11. 2012); 
Information Technology: Agencies Need to Establish Comprehensive Policies to Address 
Changes to Projects’ Cost, Schedule, and Performance Goals. GAO-08-925 (Washington, 
D C,: July 31, 2008); United States Coast Guard: Improvements Needed in Management 
and Overnight of Rescue System Acquisition. GAO-06-623 (Washington, D.C.: May 31. 
2006); and Coast Guard: New Communicatbns System to Support Search and Rescue 
Faces Challenges. GAO-03-1111 (Washington, D C,: Sept, 30, 2003), 

^'^GAO-06.823. 
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develop revised costand schedule estimates. More recently, in July 2012, 
we reported^ that the Rescue 21 program’s life-cycle cost estimate had 
grown to approximately $2.7 billion — an increase of approximately $2.4 
billion since 1999^ — and that completion was delayed to 2017, Program 
officials stated that increases in the cost estimate were due, in part, to 
additional schedule delays and more realistic estimates of future costs for 
ongoing system technology refreshment. However, we noted that the 
program’s cost estimate did not exhibit all qualities of a reliable cost 
estimate and recommended that DHS direct responsible officials to 
update future life-cycle cost estimates using cost-estimating practices that 
address the weaknesses we identified. 

DHS’s United States Visitor and Immigrant Status Indicator 
Technology (US-ViSIT) Program 

DHS’s US-VISIT program Is charged with developing a biometric 
verification capability for non-U. S. citizens entering and leaving the 
country. From fiscal year 2002 to fiscal year 2012, DHS’s US-VISIT 
program was appropriated over $3.5 billion, and the program has 
successfully developed a massive biometric database and deployed an 
entry capability. However, the program had not developed an exit 
capability and last conducted an exit pilot in 2009. We have reported on 
issues associated with key aspects of US-VISIT program management, 
such as risk management and the reliability of cost estimates and 
program schedules, as well as the lack of a completed strategic plan and 
the results of the 2009 exit pilot.^® We recommended that DHS review the 


2®GA0-1 2-629. 

^The Rescue 21 program’s original cost estimate, developed in 1999, only included 
system acquisition costs and did not include costs for operating and maintaining the 
system. These costs were subsequently included in the program’s 2005 revisions to the 
cost estimate. 

^®GAO. Homeland Security: US-VISIT Pilot Evaluations Offer Limited Understanding of Air 
Exit Options. GAO-10-860 (Washington, D.C.; Aug. 10, 2010); Homeland Security: Key 
US-VISiT Components at Varying Stages of Completion, but Integrated and Reliable 
Schedule Needed. GAO-10-13 (Washington, D.C.: Nov, 19. 2009); Homeland Security: 

U. S. Visitor and Immigrant Status Indicator Techncdogy Program Planning and Execution 
Improvements Needed, GAO-09-% (Washington, D.C.: Dec. 12. 2008); Homeland 
Security: Strategic Solution for US-VISIT Program Needs to Be Better Defined, Justified, 
and Coordinated, GAO-08-361 (Washington, D.C.: Feb. 29. 2008): and Homeland 
Security: U. S. Vi^or and Immigrant Status Program's Long-standing Lack of Strategic 
Direction and Management Controls Needs to Be Addressed. GAO-OT-IOOS (Washington, 
D.C.: Aug. 31,2007). 
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program’s approach to risk management and earned value management, 
and that DHS develop a plan and integrated schedule for a 
comprehensive exit capability. We also recommended that the program 
incorporate additional sources of information when making future 
decisions about an exit capability. However, there are no known current 
plans to develop an exit process, and the President’s fiscal year 2013 
budget request called for eliminating a standalone US- VISIT program 
office and incorporating tfie program’s mission into Customs and Border 
Protection and Immigration and Customs Enforcement. We have ongoing 
recommendation follow-up work regarding this issue. 

DOD's Armed Forces Health Longitudinal Technology Application 
(AHLTA) 

DOD has obligated approximately $2 billion over 13 years to acquire an 
electronic health record system — referred to as its AHLTA initiative. In 
October 2010. we reported that DOD had delivered various capabilities 
for outpatient care and dental care documentation, but It scaled back 
other capabilities it had originally planned to deliver, such as replacement 
of legacy systems and inpatient care management.^® In addition, users 
continued to experience significant problems with the performance 
(speed, usability, and availability) of the portions of the system that have 
been deployed. These problems were due in part to weaknesses in key 
acquisition management and planning processes. DOD initiated efforts to 
improve system performance and enhance functionality and plans to 
continue its efforts to stabilize the AHLTA system through 2015, as a 
"bridge" to the new electronic health record system It intends to acquire. 
According to DOD, the planned new electronic health record system- 
known as the EHR Way Ahead — is to be a comprehensive, real-time 
health record for service members and their families and beneficiaries. To 
help better manage these efforts, we recommended that DOD take six 
actions to help ensure that it has disciplined and effective processes In 
place to manage the acquisition of further electronic health record system 
capabilities. 


^®GAO. Opportunities Exist to Improve Management of DOD's Electronic Health Record 
Initiative, GAO-11-50 (Washington. D.C.; Oct 6, 2010). 
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DOD’s Defense Enterprise Accounting and Management System 
(DEAMS) 

The Air Force’s DEAMS is the agency’s target accounting system 
designed to provide accurate, reliable, and timely financial information, in 
March 2012, we reported that DEAMS faced a 2-year deployment delay 
and an estimated cost increase of about $500 million from Its original life- 
cycle cost estimate of $1.1 billion, an increase of approximately 45 
percent.^® Further, in February 2012, we reported that assessments by 
DOD users had identified operational problems with the system, such as 
data accuracy issues, an inability to generate auditable financial reports, 
and the need for manual workarounds.^’ We recommended that DOD 
take actions to ensure the correction of system problems prior to further 
system deployment, including user training. In July 2012, the DOD 
Inspector General reported that the DEAMS schedule delays were likely 
to diminish its intended cost savings and would jeopardize the 
department’s goals for attaining an auditable financial statement. 

OOD’s Global Combat Support System-Army (GCSS-Army) 

GCSS-Army is Intended to improve the Army’s supply chain management 
capabilities and provide accurate equipment readiness status reports, 
among other things. In March 2012, we reported that GCSS-Army was 
experiencing a cost overrun of approximately $300 million on an original 
life-cycle cost estimate of $3.9 billion (an increase of approximately 8 
percent) and a deployment delay of approximately 2 years.“ Among other 
things, we recommended that DOD ensure any future system deficiencies 
identified through independent assessments are resolved or mitigated 
prior to further deployment of the system, in addition, because the DOD 
CIO rated GCSS-Army as low or moderately low risk from July 2009 
through March 2012 on OMB’s federal IT Dashboard, we recommended 
that the department’s CIO reassess the department’s considerations for 
assigning risk levels to Investments on the Dashboard, to include external 
assessments of performance and risk. 


^°GAO. DOD Financial Management: Reported Status of Department of Defense's 
Enterprise Resource Planning Systems, GAO-12-565R (Washington, D.C,; Mar. 30. 
2012 ). 

^’GAO-12-134. 

^2GA0-12-565R. 
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DOD’s Globa! Combat Support System-Marine Corps (GCSS-MC) 

GCSS-MC is intended to provide the deployed warfighter enhanced 
capabilities in the areas of warehousing, distribution, logistical planning, 
depot maintenance, and improved asset visibility. In July 2008, we 
reported that not effectively implementing key IT management controls, 
such as economically justifying investment in the system, had in part 
contributed to a 3-year schedule slippage and a cost overrun of about 
$193 million on the first phase of the program and would likely contribute 
to future delays and overruns if not corrected. Accordingly, we made 
recommendations to address the identified deficiencies, such as cost and 
schedule estimating, risk management, and system quality measurement 
weaknesses. In October 2010,^ we reported that GCSS-MC faced a 3- 
year deployment delay on phase 1. We also reported In March 2012 that 
GCSS-MC faced an estimated cost increase of about $970 million from its 
original life-cycle cost estimate of $126 million.^® As of December 2011, 
the life-cycle cost estimate was estimated to be $1 .1 billion, and a revised 
full deployment date was being considered. 

DOD’s Navy Enterprise Resource Planning System (Navy ERP) 

Navy ERP is Intended to standardize the acquisition, financial, program 
management, maintenance, procurement, plant and wholesale supply, 
and workforce management capabilities of the Navy. In March 2012, we 
reported that Navy ERP faced a 2-year deployment delay and an 
estimated cost Increase of about $1 billion from its original life-cycle cost 
estimate of $1.87 billion.^ This estimate was later revised in August 2004, 
December 2006, and again in September 2007 to $2.4 billion. In October 
2010,^' we reported that these slippages occurred, in part, because of 
problems experienced in data conversion and adopting new business 


^^GAO, DOD Business Systems Modernization: Key Marine Corps System Acquisition 
Needs to Be Better Justified, Defined, and Managed. GAO-08'822 (Washington, D.C,: 
July 28, 2008). 

^GAO-11 -53. 

^®GAO-12-565R, DOD’s GCSS-MC Program Management Office and historical data as 
reported in GAO-1 1-53. 

^®GAO-12-565R, 

®^GAO-11-53. 
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procedures associated with implementing the Navy ERP. Moreover, in 
September 2008,^ we reported that not effectively Implementing key IT 
management controls, such as earned value management, had 
contributed to the more than 2-year schedule delay and almost $600 
million cost overrun on the program since it began, and would likely 
contribute to ftjture delays and overruns if not corrected. Accordingly, we 
made recommendations to address the identified deficiencies, such as 
improving cost and schedule estimating, earned value management, and 
risk management weaknesses. 

DOD’s Navy Next Generation Enterprise Network (NGEN) 

DOD’s NGEN is to replace the Navy Marine Corps Intranet program and 
include capabilities such as secure transport of voice and data, data 
storage, and e-mail, to be incrementally acquired through multiple 
providers. The program, which is expected to cost about $38 billion 
through fiscal year 2024, had weaknesses in its acquisition approach. 
Specifically, in March 201 1 , we reported that the program was not well 
positioned to meet its cost and schedule estimates. For example, the 
department had not sufficiently analyzed alternative acquisition 
approaches and did not have a reliable schedule for executing NGEN. 
We recommended DOD limit further investment until it conducted an 
interim review to reconsider the selected acquisition approach and 
addresses its investment management issues. In September 2012, we 
reported that while DOD had revised its acquisition approach, it was still 
suffering fi’om management issues related to measuring cost 
effectiveness, completing milestones on schedule, and mitigating risk.*° 


^®GAO, DOD Business Systems Modernization: Important Management Controls Being 
Implemented on Major Navy Program, but Improvements Needed in Key Areas, 
GAO-08-896 (Washington, D.C.: Sept. 8, 2008). 

^®GAO, Infoimation Technology: Better Informed Decision Making Needed on Navy's Next 
Generation Enterprise Netvvork Acquisition, GAO-1 1-150 (Washington, D.C.; Mar. 11, 
2011 ). 

'*°GAO. Next Generation Enterprise Network: Navy Implementing Revised Approach, but 
Improvement Needed in Mitigating Risks, GAO-12-956 (Washington, D.C.: Sept. 19, 

2012). 
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DOD/Department of the Treasury’s Navy Cash Program 

Initiated In 2001, Navy Cash is a joint Department of the Navy and 
Department of the Treasury Financial Management Service program to 
create a cashless environment on ships using smart card technology. It 
was estimated to cost about $320 million to fully deploy. In 2008, we 
reported that the system had not been assessed and defined in a way to 
ensure that it was not duplicative of programs in the Air Force and the 
Army that use smart card technology, nor economically justified on the 
basis of reliable analyses of estimated costs and expected benefits over 
the program’s life. In addition, we reported that system requirements 
and system security had not been effectively managed. Program 
oversight and management officials acknowledged the weaknesses and 
cited turnover of staff in key positions and their primary focus on 
deploying Navy Cash as reasons for the state of some of the IT 
management controls. We concluded that after investing about 6 years 
and $132 million on Navy Cash and planning to invest an additional $60 
million to further develop the program, the department had yet to 
demonstrate through verifiable analysis and evidence that the program, 
as currently defined, was justified. Accordingly, we recommended that 
investment of modernization funding in the program be limited until a 
basis for informed decision making was established, and that other 
program management weaknesses were corrected. 

DODA^A’s Integrated Electronic Health Record (iEHR) 

DOD and VA have been challenged over the last 15 years on a variety of 
initiatives to share data among the departments’ health information 
systems. In March 201 1 , the Secretaries of DOD and VA committed their 
two departments to developing a new common iEHR, and in May 2012 
announced their goal of implementing it across the departments by 2017. 
According to the departments, the decision to pursue iEHR would enable 
DOD and VA to align resources and investments with common business 
needs and programs, resulting in a platform that would replace the two 
departments’ electronic health record systems with a common system. 
The departments estimated the life-cycle cost of this effort at about $25 
billion. However, as we noted in a recent testimony, the Secretaries 


^^GAO, DOD Business Systems Modernization: Planned Investment in Navy Program to 
Create Cashless Shipboard Environment Needs to Be Justified and Better Managed, 
GAO-08-922 {Washington. D C.: Sept. 8. 2008). 
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Appendix I: Examples of IT Preset Failures 
and Challenges 


announced in February 2013 that instead of developing a new common 
integrated electronic health record system, the departments wouid focus 
on integrating health records from separate DOD and VA systems/^ VA 
has stated that it will continue to modernize its existing system, called 
VistA, \A^ile pursuing the integration of health data, while in May 2013, 
DOD announced that it planned to purchase a commercial off-the-shelf 
product. The Secretaries offered several reasons for this new direction, 
including cutting costs, simplifying the problem of integrating DOD and VA 
health data, and meeting the needs of veterans and service members 
sooner rather than later. Nevertheless, the departments’ recent change in 
the program’s direction and history of challenges to improving their health 
information systems heighten concern about whether this latest initiative 
will be successful. 

DOD/VA’s Federal Health Care Center (FHCC) 

DOD and VA jointly undertook an IT project to support the FHCC in North 
Chicago, Illinois, which Is the first medical facility to serve both 
departments' patient populations while operating under a single line of 
authority. As we reported in February 201 1 , despite an investment of 
more than $122 million, none of the FHCC’s required IT capabilities had 
been implemented as planned when the center opened in October 
2010.“*^ While system components to support single sign-on and single- 
patient registration became operational in December 2010, a component 
to support medical consults was not expected to be completed until 
March 2013, and the departments did not have a schedule for completion 
of the component to support pharmacy. We recommended that the 
departments strengthen their joint IT system planning efforts for the 
FHCC by developing plans that include scope definition, cost and 
schedule estimation, and project plan documentation and approval. We 
also noted that the two departments face barriers in three key IT 
management areas — ^strategic planning, enterprise architecture, and 
investment management — and recommended steps for improvement. 


^^GAO, Electronic Health Records: Long History of Management Challenges Raises 
Concerns about VA‘s and DOD's New Approach to Sharing Health Infonnation, 

GAO-1 3-41 3T (Washington. D.C.; Feb. 27. 2013). 

'’^GAO, Electronic Hea/th Records: DOD and VA Should Remove Earners and Improve 
Effyrts to Meet Their Common System Needs, GAO-11-265 (Washington. D.C,; Feb. 2, 
2011 ). 
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Appendix I: Examples of IT Project Failures 
and Challenges 


FDA’s Mission Accomplishments and Regulatory Compliance 
Services (MARCS) 

FDA’s MARCS program is intended to automate workflow, help track and 
manage information about firm compliance with FDA’s regulations, and 
eliminate FDA’s existing stove-piped databases. However, the program 
has been rebaselined five times since 2002, the total estimated cost has 
grown from $221.4 million to $282.7 million, and the estimated completion 
date for initial development has slipped from September 2008 to October 
2016. According to OMB exhibit 53s from 2004 to 2013, FDA has spent 
approximately $160 million from fiscal year 2002 to fiscal year 201 1 on 
MARCS. In March 2012, we reported FDA had not developed a 
comprehensive integrated master schedule for MARCS that would allow 
the agency to effectively gauge progress."*^ We further reported that the 
agency was reevaluating the scope of the initiative and concluded that, 
until this assessment was complete, it was uncertain how or when much 
of the intended functionality and improvements associated with MARCS 
would be delivered. We recommended that FDA, in completing the 
assessment of MARCS, develop an integrated master schedule that 
identifies which legacy systems will be replaced and when; identifies all 
current and future tasks to be completed; and defines and incorporates 
information reflecting needed resources and critical dependencies. We 
further recommended that the agency use this schedule to monitor the 
progress of MARCS. 

IRS’s Customer Account Data Engine (CADE) 

in December 201 1 , IRS ended further development of CADE, its effort to 
replace legacy systems for storing, managing, and accessing individual 
taxpayer accounts. IRS started developing this system in 2002 to replace 
the legacy Individual Master File processing system and house tax 
information for more than 40 million taxpayers while providing faster 
return processing and refunds. In December 2009, we reported that after 
over 5 years and $400 million, CADE was only processing about 15 


^GAO, Infoimation Technology: FDA Needs to Fully Implement Key Management 
Practices to Lesson Modernization Risks, GAO-12-346 (Washington, D.C.: Mar. 15, 
2012 ). 
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Appendix I: Excunples of IT Projecl: Failures 
and Challenges 


percent of the functionality originally planned for completion by 2012/® In 
addition, each successive release of the system was expected to process 
more complex returns, but several technical challenges had not been 
addressed. Given this. IRS estimated that full implementation of CADE 
would not be achieved until at least 2018 or possibly as late as 2028. As 
a consequence, in 2011 IRS decided to stop development of new CADE 
functionality and rethink its strategy for modernizing individual taxpayer 
accounts to determine whether an alternative approach could deliver 
improvements sooner. This led to the development of CADE 2, a new 
program for replacing the Individual Master File. Beginning In January 
2012, IRS started using CADE 2 to process returns daily and issue 
refunds faster for about 84 million taxpayers. As of January 201 3, IRS 
reported that there have been no significant problems with the system. 

NASA’s James Webb Space Telescope (JWST) 

NASA’s JWST project is designed to advance understanding of the origin 
of the universe. Since 2006, we have identified a range of issues with the 
project. For example, in July 2006, we reported"*® that the JWST project 
had experienced costgrovrth exceeding $1 billion — which increased its 
life-cycle cost estimate from $3.5 billion to $4.5 billion — and its launch 
date had slipped nearly 2 years to 2013. We also found that the program 
was not fully adhering to a knowledge-based acquisition approach, which 
ensures that resources match requirements in terms of knowledge, time, 
and money before program start. Accordingly, we recommended that the 
program apply such an approach. In October 2009, we reported that as of 
May 2009, the JWST contractor exceeded its planned cost target by 
$224.7 million and had not completed $9.4 million in planned work.^^ A 
key driver in this cost overrun was greater-than-expected compieMty in 
the work, which required additional resources. We concurred with the 
contractor’s estimate that it would overrun its budget— worth 
approximately $1.3 billion — by $448.5 million. We also found that the 
program had not fully implemented practices for earned value 
management and recommended steps for improvement. In 201 1 , the 


'*®GAO, 2009 Tax Filing Season: IRS Met Many 2009 Goals, but Telephone Access 
Remained Low. and Taxpayer Service and Enforcement Could Be Improved. GAO-1 0-225 
(Washington, D.C.: Dec. 10. 2009). 

'‘®GAO-06-634. 

^^GAO-10-2. 
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and Challenges 


project finalized a major replanning that resulted in further growth to the 
project's expected costs, as well as additional delays to its expected 
launch date. On the basis of the replanning, NASA announced that the 
project would be rebaselined at approximately $8.8 billion — a 78 percent 
Increase to the project’s life-cycle cost compared to the previous 
baseline — and would launch in October 2018 — a delay of 52 months, 

USDA’s Modernize and Innovate the Delivery of Agricultural 
Systems (MIDAS) Program 

USDA’s MIDAS program is intended to modernize the IT systems 
supporting the Farm Service Agency’s 37 farm programs. As we reported 
in July 2011, the implementation cost estimate Is approximately $305 
million, with a life-cycle cost of approximately $473 million.'*® However, we 
found that the implementation cost estimate was uncertain because it had 
not been updated since 2007, and the program schedule had not been 
updated to account for delays. In addition, we reported that the program’s 
management approach, while including many leading practices, could be 
strengthened. Finally, we found there was a lack of clarity and definition 
regarding the roles of executive-level governance bodies responsible for 
overseeing the program. We recommended that USDA update cost and 
schedule estimates, address management issues, and clarify the roles 
and coordination among governance bodies. 


*®GAO, USDA Systems ModemizaSon: Management and Oversight Improvements Are 
Needed, GAO-1 1-586 (Washir^gton, D.C.: July 20, 201 1 ). 
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Mr. Mica. Thank you. 

We will go now to 0MB, Mr. VanRoekel. You are recognized. 

STATEMENT OF THE HONORABLE STEVEN VANROEKEL 

Mr. VanRoekel. Thank you. Good morning, Chairman Mica and 
members of the committee. Thank you for this opportunity to tes- 
tify on the Administration’s efforts to improve the management of 
Federal information technology. 

Since day one, the Administration has focused on harnessing 
technology to improve the operations of Government and better 
serve the American people. As I saw through my nearly 20 years 
in the private sector, including a stint as an assistant to Microsoft’s 
founder. Bill Gates, the innovative application of technology can 
transform organizations, enabling them to improve service delivery 
and expand customer value, while also cutting costs. As a Federal 
Chief Information Officer and now Acting Deputy Director for Man- 
agement at the Office of Management and Budget, I am charged 
with bringing my experience and tools from the private sector to 
help take Government built for the 20th century into the 21st. 

This fundamentally requires a shift in how we think and how we 
operate. As leading private sector companies do, we must relent- 
lessly focus on outcome and results; work collaboratively across tra- 
ditional organizational boundaries; drive innovation; foster account- 
ability; and, above all, put our customer, the American people, first. 
High-performing organizations are results-driven, focused on cus- 
tomer-facing outcomes rather than inward-looking outputs. They 
set business-oriented targets, such as revenue and profit goals, and 
then let operating units determine how best to achieve them. 

This thinking underpins our revamped approach to data center 
consolidation. Whereas, early on we looked primarily at raw out- 
puts, tasking agencies with counting the number of data centers 
and tallying closures, we are now building on that first work by 
taking an outcome-and incentive-based approach, focusing on opti- 
mizing total cost of ownership and efficiency of operations instead 
of just the number of data centers. Agencies are now developing 
metrics that drive the outcomes we want to see: lower costs and 
higher productivity. Beyond closures and savings, we are now 
tracking metrics, including energy, facilities, labor, virtualization, 
and cost per operating system in these data centers. 

Additionally, successful enterprises are not constrained by tradi- 
tional organizational boundaries, and operate in an integrated and 
unified manner. In the case of IT’s, this means treating CIO’s as 
strategic partners, on par with the other parts of the business. 
That is why, through PortfoIioStat, a data-driven review of agency 
IT portfolios, I am pulling together agency leaders: deputy secre- 
taries, CIO’s, CFO’s, CAO’s, chief human capital officers, and pro- 
gram officials. We all sit around the table and ask them to engage 
beyond their individual roles to make decisions collaboratively with 
a focus on delivering value to the American people. 

In taking this holistic approach to governance, we are aiming to 
avoid one-off isolated actions that can lead to unintended con- 
sequences. And by working as an integrated leadership team, we 
can better identify and eliminate duplicative and redundant invest- 
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ments that drain vital resources from mission-facing programs and 
activities. 

However, just as with any leading private sector initiative, the 
success of PortfolioStat hinges on being able to hold leadership ac- 
countable for results. This is why a key part of the annual 
PortfolioStat process is following up on commitments made in the 
previous cycle and evaluating agencies on progress over the prior 
year, something we do quarterly. 

This is also why we are sharing the results of our efforts to gen- 
erate efficiencies across the IT portfolios with Congress through our 
lUIT report, the way we track cost-savings. To date, agencies have 
reported over $800 million in savings from PortfolioStat alone, with 
more on the way, and I am very proud that, as of this morning, 
slightly over a year of having this process in place and this cost- 
saving track in place, we are announcing that we reached $1.37 bil- 
lion. 

But to achieve breakthrough results, we must drive innovation 
throughout the Government. Innovative new technologies such as 
cloud computing, open data, mobile, are transforming how IT serv- 
ices are delivered and consumed. Through these new technologies, 
CIOs must shift from maintaining high-risk, high-failure mono- 
lithic systems, many of which you have highlighted here, that sap 
these IT development budgets. We need to shift to using services 
comprised of small, agile modules that lower risk and support 
emerging needs. 

In the end, all of our efforts must be in service for the customer, 
the American people. The aim is to provide agencies the ability to 
allocate their resources to high-value, mission-oriented activities, 
rather than commodity and back office functions, so the Govern- 
ment can focus on what matters most, the citizen. 

We have made significant progress over the past year, but work 
is yet to be done. We must continue to engage agency leadership 
through the PortfolioStat process, hold agencies accountable for the 
results, track savings, and keep our sights set on building the Gov- 
ernment on the 21st century. 

Thank you. 

[Prepared statement of Mr. VanRoekel follows:] 
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Good morning, Chairman Mica, Ranking Member Connolly, and Members of the Subcommittee, 
Thank you for this opportunity to testify on the Administration’s efforts to improve the 
management of Federal Information Technology (IT) investments and the use of data centers and 
cloud computing across the Federal Government. 

Since day one, the Administration has been focused on harnessing the power of technology to 
improve the operations of Government and deliver better service to the American people. While 
our IT investments make up a relatively modest portion of total Government spending, they have 
far-reaching impacts and touch upon almost every aspect of Government activity. And as 1 saw 
throughout my nearly twenty year career in the private sector, the innovative application of 
technology can transform organizations - enabling them to tap into new markets, streamline 
operations, and do more with less. As the Federal Chief Information Officer (CIO) and Acting 
Deputy Director for Management at the Office of Management Budget (OMB), I am charged 
with bringing that same mindset to Government agencies. 1 come to work every day with my 
sights set on building the IT organization of the future, the agency of the future, and the 
Government of the future that will best serve the American people. 

We have already taken significant steps forward to help get us there. In March 2012, OMB 
launched PortfolioStat' to take an objective, data-driven look across agencies to identify 
common areas of spending with the intent of reducing duplication and lowering costs. So far, we 
have identified nearly 100 opportunities to consolidate or eliminate redundant or otherwise 
unnecessary IT investments representing more than $2.5 billion in potential savings that can be 


h{ip:/V\v\vvv.\vhiiehouse.gov/5;iic.s/dcfault^nies/omb/mcHioranda’'20i2/m-l2-l() l-pdf . 
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achieved from Fiscal Year (FY) 2013 through FY 2015. Agencies have already reported 
approximately $800 million in realized savings and more on the way. Currently, we are in the 
process of conducting FY 2013 PortfolioStat^ sessions and we look forward to continued 
progress and identification of further opportunities for improvement across the Federal IT 
portfolio. Under PortfolioStat, we are rationalizing our outdated IT infrastructure through the 
Federal Data Center Consolidation Initiative (FDCCI). As of May 2013, agencies have closed 
484 data centers, with a total of 855 planned closures by the end of FY 2013. 

To innovate our government, we launched the Digital Government Strategy in May of 2012. 

This effort enabled us to reboot how our Government architects and operates IT systems, open 
up Government data to streamline agency operations and harness the innovative spirit of the 
American people, and drive the use of mobile computing and other innovative technologies and 
approaches. In May 2013, the President issued an Executive Order’ and launched the 
Administration’s new Open Data Policy, taking concrete steps to make Government data more 
accessible and useful for the public and entrepreneurs to ignite economic growth and innovation. 

We look forward to continuing to build on these accomplishments as we move forward, as 
today’s challenging economic times only emphasize the need to continue to drive innovation and 
efficiency in our Government. We need to continue to harness the transformative power of IT to 
enable our government to deliver more for the American people at lower costs. And as 
technology evolves at an ever-increasing pace, we need to continually look for new ways to 
better serve the citizen. We must keep our sights set on building the IT organization of the 
future. We must continually strive for ideal. 

Technology Organizations Designed to Deliver 

Information technology enables us to deliver mission services to customers - in our case, the 
American people. The most effective technology organizations are able to focus on higher- 
value, mission-oriented activities rather than on commodity and back-office functions, as those 
activities are routinely being implemented well. For example, instead of focusing on email 
traffic, they focus on air traffic; instead of focusing on server farms, they focus on serving 
farmers. Chief Information Officers should also serve as catalysts for innovation - bringing in 
new technologies, such as cloud services and mobile computing, to improve customer service, 
maximize return-on-investment, and spark innovation across the agency. Agency CIOs must 
partner with those leading mission delivery units to together focus on most efficiently and 
effectively delivering customer-facing outcomes. 

Getting There 


^ hltp://wwvv.whitehouse.gov/sitcs/defaull/file.s/Qmb/memoranda/2Ql 3/m-l 3-09.pdf . 
3 hllD://vvwtv.gDO.gov/fdsv5/Dka.1)C(»D-2()l.300318/lxlt?DCPD-2()B(ll»l8.iidl' . 



62 


Getting to the idea! IT organization, within agencies, requires a shift in how we think and how 
we operate. To get this right, we need to think not in terms of how to do things but rather in 
terms of what to do; not in terms of individual investments or stove piped organizational silos but 
rather in terms of entire investment portfolios and integrated management teams; not in terms of 
monolithic purpose-built systems but rather in terms of reusable component-based solutions. 

This is the shift we are undertaking now through PortfolioStat and other management efforts. 

Focusing on Outcomes: Shifting From “How" to “What” 

To be truly effective, CIOs need to be able to exercise leadership in IT governance, spending, 
security, and program management across the enterprise. The needs of our customers - the 
American citizens - drive the “what” the CIOs help to determine the “how.” This thinking 
underpins the recent shift in the approach to data center consolidation. In the initial stages of the 
effort, it was necessary to focus on data center counts and physical closures. Today, we are 
looking at new incentives are focused on a more outcome-based approach, to improve the overall 
efficiency and effectiveness of data center operations to optimize total cost of ownership. To this 
end, as we evolve the FDCCI as part of the FY 2013 PortfolioStat process, we are developing a 
comprehensive suite of outcome-focused metrics. The metrics - to be finalized later this 
summer -- will span the full range of data center capabilities, and include energy, facility, labor, 
storage, virtualization, and cost-per-operating system metrics. 

Additionally, given the current state of technology, we realized it does not make sense to treat all 
data centers the same. We first expanded the scope of our data center inventory to a broader 
range of sizes to better assess the current state, and we then established the concepts of core and 
non-core data centers. A core data center is a highly-optimized, multi-use facility that serves as a 
fulcrum for mission service delivery, anchors the agency’s platform for shared services, and 
provides rigorous and ironclad processes for security and redundancy. Non-core data centers are 
any remaining agency data centers not meeting this definition. 

To best achieve our desired outcomes, we are asking agencies to continue to consolidate non- 
core data centers and to optimize the efficiency of core data centers for total cost of ownership 
under the FDCCI. We believe this approach provides agencies with the right incentives and 
measures to drive behavior that will optimize the Federal Government’s use and allocation of its 
computing resources. 

Designing for Re-Use 

Recent advances in technology, such as cloud computing and collaborative, modular 
development, are transforming how IT services are delivered and consumed. These shifts are 
forcing agencies to think more in terms of reusable components as opposed to purpose built 
systems. By providing “technology-as-a-service,” cloud and services based approaches offer a 
viable alternative to building more data centers. In most cases, agencies no longer need to make 
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costly investments in large-scale data centers when computing power and IT services are readily 
available on demand. Chief Information Officers can shift from maintaining monolithic systems 
that sap budgets for new development to establishing platforms built on smaller modules that 
reduce the risk surface of large investments and support emerging needs across the agency. 

Analyzing the Enterprise 

TechStats, initiated in January 2010, were designed as face-to-face, evidence-based 
accountability reviews of IT investments that enabled the Federal Government to intervene to 
turn around, halt or terminate agency IT projects that were failing or not producing results for the 
American people. As such, TechStats were an important first step in curbing wasteful IT 
spending, 

PortfolioStat represents the next step in shifting the focus for how we manage Federal IT. The 
intent of PortfolioStat is to provide agency leadership with a forum to collectively examine IT 
strategies, targeted outcomes, and overarching management processes across the portfolio, and to 
identify opportunities for improvement. 

By taking this more holistic view of IT at the portfolio level, rather than at a siloed investment 
level, it allows us to uncover additional opportunities for streamlining IT investments and 
reducing IT spending. So, while the initial success of PortfolioStat generated significant cost 
reduction opportunities in areas of commodity IT by consolidating or eliminating duplicative 
systems, or through making bulk IT purchases, going forward we are taking PortfolioStat to the 
next level by further analyzing spending and integrating FDCCI and cloud efforts with enterprise 
portfolio management decisions. In taking such a broad, integrated view, we can get at the root 
of the systemic issues which have led to the large-scale failures, cost overruns and schedule 
delays that have for too long plagued our largest and often most important IT investments. 

Agency leaders, whether CIOs, Chief Acquisition Officers, Chief Financial Officers, Chief 
Human Capita! Officers or Program Officials, mu.st engage beyond their individual roles and be 
strategic partners to ensure that decisions are driven by cross-functional data in the best interests 
of the American people. The PortfolioStat process fosters this cultural shift by driving 
consensus-driven decision making, rather than one-off isolated actions that may lead to 
unintended consequences, benefitting one organization at the expense of another. 

1 appreciate this committee’s interest and continuing support. Thank you again for the 
opportunity to appear before the committee today and I look forward to answering your 
questions. 
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Mr. Mica. Thank you. 

We will hear from our final witness on the panel, Mr. David 
McClure, and he is with GSA. Welcome and you are recognized. 

STATEMENT OF DAVID L. MCCLURE 

Mr. McClure. Thank you. Chairman Mica, and thanks, mem- 
bers of the subcommittee, for having me here today to talk about 
our efforts in data center consolidation and our partnership with 
0MB and our sister agencies to optimize new technologies being 
put into the Government. I want to focus on how my office at GSA 
is working in concert with 0MB, the CIO Council to strengthen 
Government approaches to IT management, including consolidation 
and cloud security. 

As Steve noted in his remarks, our present approach with data 
center consolidation efforts in the Federal Government is focused 
on economies of scale and achieving greater efficiencies and overall 
IT portfolios by optimizing core data center performance. This is 
more meaningful than a singular focus on closure counts as the pri- 
mary measure of success. 

Our role at GSA is to work in concert with 0MB, the CIO Coun- 
cil, and its Federal Data Center Consolidation Task Force to as- 
semble a complete view of the data center inventory and key vari- 
ables affecting operational performance, and we do that by pro- 
viding practical tools, standard data collection templates, guidance 
to the agencies for planning and executing their strategies, and 
consolidating their data centers. 

For example, we have created an online inventory portal where 
agencies can download the data being requested for their strategies 
and plans. We have developed a tool that helps agencies identify 
and select their core data centers. The tool uses nine draft criteria 
that we have reached consensus on Government- wide. Most impor- 
tantly, we have built a world-class total cost of ownership model to 
facilitate robust data analysis, optimization planning, and data- 
driven decision-making, and it is now being used by all 24 CFO Act 
agencies. 

Industry experts and GAO have given the model very positive as- 
sessments. It allows agencies to analyze different scenarios to cal- 
culate the effects of different data center optimization strategies. It 
also allows, for the first time, an apples-to-apples comparison with 
other agencies as they examine outsourcing and cloud infrastruc- 
ture options. Of course, we continue to expect to enhance the model 
with continued input from the CIO Council and from 0MB. 

We are working in concert with the community on multiple 
fronts to get better results with IT investments being made in the 
Federal Government. The Federal Government, for the first time, 
has a comprehensive inventory of its data centers, one of the larg- 
est cost items in the Federal IT portfolio. As a result of our data 
collection and our TCO data model, agency CIO’s have more trans- 
parency into how these centers are being utilized and viable op- 
tions for optimizing their operational performance. 

In summary, the partnership that Steve and I have forged be- 
tween our offices for management change is grounded in our own 
private sector experience, using industry-leading practices that em- 
phasize data-driven decision-making. I think Steve is bringing the 
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power of performance metrics to bear on the Federal CIOs as a 
lever for change. 

I want to thank you for having me here this morning. I am 
happy to answer any questions about GSA and our role. I really ap- 
preciate the leadership of this subcommittee and the full com- 
mittee, because it is paramount to IT reform success, and we wel- 
come continued interactions with you and your staff as we find 
meaningful ways to facilitate effective Federal IT investment re- 
sults. And I would be happy to answer any questions from the sub- 
committee. 

[Prepared statement of Mr. McClure follows:] 
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GSA 


Chairman Mica, Ranking Member Connolly, and Members of the Subcommittee: 

Thank you for the opportunity to appear before you today to discuss GSA’s role in the 
Federal Data Center Consolidation Initiative (FDCCI). We are fully committed to 
helping our agency partners achieve significant government-wide gains in efficiency 
and operational excellence through data center consolidation, and appreciate the 
Committee’s leadership in ensuring the effectiveness of this important initiative. 

Background 

The Administration launched the Federal Data Center Consolidation Initiative (FDCCI) 
in 2010 to stem the large increase in federal data centers that had occurred over the 
past decade. Establishment of the FDCCI coincided with the initial drive to migrate 
federal IT infrastructure to cloud computing solutions, providing a framework for 
development of a baseline inventory that would enable agencies to make data-driven 
decisions about how to gain efficiencies and achieve cost savings within their IT 
infrastructure. Initially, four high level goals were defined: 

• Promote the use of Green IT by reducing the overall energy and real estate 
footprint of government data centers 

• Reduce the cost of data center hardware, software, and operations 

• Increase the overall IT security posture of the government 

• Shift IT investments to more efficient computing platforms and technologies 

In February 2010, the then Federal CIO issued guidance requiring agencies to identify 
their existing data center assets and formulate detailed consolidation plans that 
include a roadmap and consolidation targets. Specific requirements include: 


2 



68 


• Conduct an initial inventory of data center assets and provide a complete 
inventory update annually 

• Formulate and maintain a data center consolidation plan that identifies centers 
for consolidation, opportunities for optimization through server virtualization or 
cloud computing, and incorporate this plan into annual agency budgets 

• Prepare a high level roadmap to transition to the consolidated end state 
architecture 

Over the past three years, these goals and requirements have evolved to shift 
emphasis toward portfolio management, as agencies work to optimize and consolidate 
their data center populations. 

GSA Role 

GSA's Office of Citizen Services and innovative Technologies administers the inventory 
of agency assets, collects data from agencies, and supports the Federal CIO Council’s 
Data Center Task Force (Task Force). We provide agencies with practical tools, 
templates and guidance to effectively plan and execute their strategies to consolidate 
and close data centers. 

We also maintain the on-line data center inventory portal, and provide analytics to Office 
of Management and Budget (0MB) based on the inventory data submitted by agencies. 
Each agency is responsible for the quality and accuracy of the data they submit; agency 
Chief Information Officers (CIOs) are responsible for the validity of the inventory data 
submitted. We are responsible for reviewing agency Inventories to identify missing 
information - data fields that have not been completed. We do not verify or determine 
the extent to which the data provided accurately reflects an agency’s actual assets. We 
coordinate closely with the Task Force members and 0MB to help agencies achieve our 
shared objectives, and strive to meet emerging needs with on-going program 
improvements. 

Inventory Reporting 

initially, 0MB required agencies to report only data centers that were greater than 500 
square feet in size and that met one of the tier data center classifications defined by the 
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Uptime institute. Based on that definition, the first data center inventory, reported in 
October 2010, identified the data center asset baseline as 2,094 data centers, in 
December 2010, 0MB issued the 25 Point Implementation Plan to Reform Federal 
Information Technology Management, which set a target for agencies to consolidate at 
least 800 data centers, which was approximately close 40% of agency reported data 
centers, by the end of 2015. 

Once these Initial results were examined, 0MB determined that this approach did not 
capture a significant segment of agency infrastructure assets that could be consolidated 
and optimized. Data provided through April 30, 2013 indicated that more than 70% of 
agency data center assets are less than 500 square feet, with many of those assets 100 
square feet or less. Although the individual budgets for these server ‘closets' are low 
and often contain embedded costs in overall building utilities, in aggregate across 
government, the costs of these data centers are significant. To achieve meaningful and 
sustainable infrastructure optimization, it is critical that agencies plans include the 
consolidation of these smaller assets into large, core data centers that address broad 
agency needs, for example shared and enterprise services. 

To address this gap, the data center definition was changed in late 201 1 and officially 
clarified in March 2012. Under the FDCCI, a data center is now defined as “a closet, 
room, floor or building for the storage, management, and dissemination of data and 
information. Such a repository houses computer systems and associated components, 
such as database, application, and storage systems and data stores. A data center 
generally includes redundant or backup power supplies, redundant data 
communications connections, environmental controls (air conditioning, fire suppression) 
and special security devices housed in leased (including by cioud providers), owned, 
collocated, or stand-alone facilities,' 

As you would expect, this broader definition resulted in agencies identifying and 
reporting higher number of data centers. While this has created challenges in defining 
the government-wide inventory baseline, it provides a far more accurate view of each 
agency's enterprise assets, and enables more comprehensive portfolio analysis. 


Agencies directly upload asset inventory information using standard templates to an 
on-line Inventory Portal that we developed to automate reporting and ensure 


I This definition excludes facilities exclusively devoted to communications and network equipment (e.g., 
telephone exchanges and telecommunications rooms). 
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consistency. Agencies are responsible for data quality, accuracy, and completeness, 
and can review, correct and augment information as needed. As required by 0MB, 
they must update closure information quarterly and their entire inventory on an annual 
basis, Each agency has access to its own information, but cannot access information 
of other agencies. The porta! provides portfolio level transparency, enabling analysis 
and planning, both by agency managers and 0MB. It gives 0MB insight on 
government-wide asset inventory accuracy and completeness, which is critical to 
achieve optimization of the Federal IT enterprise. 


Core Data Center Selection 

The FDCCI has shifted from focusing strictly on closures to measuring efficiency of 
agency data centers in the context of overall agency IT portfolios. Based on the March 
27, 2013 PortfolioStat memo from 0MB, the FDDCI Task Force (Task Force) is 
categorizing agency data center populations into two categories; 
core and non-core. Core Data Centers are fundamental components of the agency's 
post consolidation environment. They will serve as primary consolidation points for 
enterprise IT services allowing the Department/Agency to achieve economies of scale 
and deliver the lowest possible Cost per Operating System per Hour (COSH). They are 
required to have sufficient power and cooling to support anticipated operations, 
appropriate redundancy to meet availability requirements, adequate space for 
anticipated growth, appropriate levels of physical security, support delivery of IT 
services for a diverse community of customers over a wide geographic area, and to 
comply with Federal and industry best practices for energy efficiency and operations. 

These categories will encourage agencies to concentrate on optimizing their core 
centers across total cost of ownership metrics, while striving to reach the government- 
wide goal of closing 40% of non-core data centers. 

In conjunction with the Task Force, GSA developed a tool to help agencies identify 
and select their core data centers. It defines nine draft criteria that are key attributes 
for core data centers. Using these criteria, in addition to other agency information, 
agencies are currently identifying their core data centers in this year's PortfolioStat 
process: 

• Power usage effectiveness (PUE) must be lower than 3.0 

• Data center must be metered for use of electricity 

• Agency must have sufficient information to calculate a cost of operating system 
per hour (COSH) score 


5 



71 


• Virtualization must be at least 40% - Virtualization is defined as a technology that 
allows multiple, software-based machines, with different operating systems, to 
run in isolation, side-by-side, on the same physical machine, 

• There must be at least a ratio of 10 servers per full time equivalent (FTE) 

• Power capacity must be at least 30 watts per square foot 

• Facility utilization must be between 20% and 80% of the data center space 

• Data center must meet at least the Tier One standards defined by the Uptime 
Institute 

• Data center must be agency owned, leased or in the cloud 

Total Cost of Ownership (TCO) Model 

Under the guidance of the FDCCI Task Force, GSA also developed a Total Cost of 
Ownership (TCO) model to facilitate robust data analysis and optimization planning by 
agencies, it models alternative consolidation paths, supports development of 
projected and modeled cost savings figures and funding needs, and enables informed, 
data driven decision making. The model was first made available to agencies in early 
2012 as a planning tool. Agencies were encouraged to use it and vet the business 
rules governing data normalization and processing. In addition, CAO reviewed the 
logic and business rules of the model. All 24 CFO Act agencies are now using the 
TCO model. Furthermore, the TCO Model is being migrated into a cloud-hosted 
application that agencies can easily access and use. 

The primary TCO model's primary capabilities are: 

• Aggregates data center costs and calculates the cost of delivering an operating 
system, whether virtual or physical. This allows agencies to compare data center 
costs to alternative hosting solutions and provides an overall snapshot of cost 
models. 

• Provides information and analysis for CIOs to make educated, cost-based 
decisions on what data centers to optimize and consolidate, assess the impact of 
potential optimization and consolidation decisions, and to determine where to 
most cost effectively deploy applications across their portfolio. 

• Provides an executive level dashboard for agencies to analyze different 
scenarios to calculate the potential return on consolidation/optimization 
investments - e.g. how much will increasing virtualization save the agency? 


As recommended by commercial and public sector best practice, the TCO Model uses 
the operating system (OS) as the base commodity for measuring efficiency and cost. It 
breaks down costs associated with data center ownership to the cost per OS per hour 
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(COSH) level. Commoditization of data center resources at the OS level allows for 
direct, apples to apples comparison with other agencies and across agency sub- 
components, as well as with cloud-based Infrastructure, outsourcing and other 
infrastructure options. Agencies can make better, more informed consolidation and 
optimization decisions by using the TCO Model to analyze alternatives and associated 
projected costs, it enables agencies to weigh specific factors against of series of 
optimization and consolidation actions which, if taken, should enable improved mission 
service delivery. 

As agencies have gained experience with the tool and its applicability to IT planning, 
they have requested updates and changes. GSA and the FDCCI Task Force's 
Configuration Change Control Board evaluate all change requests, and prioritize 
approved changes. The model has been modified and enhanced overtime to reflect 
these recommendations. 


Conclusion 

The FDCCI has made significant strides identifying, analyzing and optimizing Federal 
data centers across government. To date, over 4B4 data centers have been closed, 
with another 855 scheduled for closure by the end of FY 1 3. Data Center 
consolidation is an important part of broader federal IT reform focused on optimizing 
investments and resulting operational efficiencies that improve mission, results. GSA 
is providing vaiuable, practical tools and support to agencies that enable accurate, 
complete data center inventories and analysis. While there is much to be 
accomplished in the years ahead, we are assembling a more complete, accurate and 
transparent inventory of data center assets than has previously existed. 
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Mr. Mica. Okay, we will catch all of you right now, and I will 
start off with some questions. 

First of all, let’s look, Mr. Powner, Mr. VanRoekel. We started 
out in June of 2012, I guess, actually, in April of 2013 we were told 
that there were 3,133 data centers. Now we are told it is over 
7,000. Kind of a slight miscalculation. And then I think there were 
a couple gasps from members of the panel, joint bipartisan gasps 
when you said, Mr. Powner, that the Federal Government really 
doesn’t know what it has. What is going on? 

Let’s start with Powner. 

Mr. Powner. Well, first of all, the 3100, we did report that at 
your May field hearing, and GAO found through our audit follow- 
up, we follow up with each agency, that there were an additional 
3,000 centers that were reported. 

Mr. Mica. So do you think the next time you come back we will 
be up to like 10? 

Mr. Powner. Well, we are up to 7,100 now. 

Mr. Mica. I mean, there was a collective gasp when you said 
Government maybe really doesn’t know what it has. 

Mr. Powner. And I stand by that statement. I think there are 
7100 now. Hopefully, we know what we have, but I wouldn’t put 
money on it. 

Mr. Mica. And I think, actually, now, wasn’t it you also, I have 
your little notes here, you said the savings could exceed $5 billion 
to $6 billion, rather the $3 billion that was projected? 

Mr. Powner. Well, with the PortfolioStat initiative we have 
agencies reporting to us there is a $2.5 billion number floating 
around out there. Most agencies reported 2.4, then DOD came in 
alone and said they could save somewhere between $3 billion and 
$5 billion. So I think the $5 billion to $6 billion range is very accu- 
rate for savings on PortfolioStat. 

Mr. Mica. Then VanRoekel, he comes up and says today he is 
proud to announce the $1.37 billion in savings. That is your new 
number? Where did you get that? 

Mr. VanRoekel. So, sir, we report quarterly to Congress through 
a mechanism called the lUIT report. That lUIT report cleared yes- 
terday and was transmitted to Congress. 

Mr. Mica. For today? So instead of, where the hell were we here? 
We were at, this is projected savings were about $300 million by 
0MB according to a May report, and now you are saying we have 
jumped a billion? 

Mr. VanRoekel. There are sort of two numbers that we are 
tracking simultaneously here. 

Mr. Mica. Is that from the closure of the 484? It says you have 
a total plan closure of almost double that, 855. So have you had 
a sudden lightening expansion. 

Mr. VanRoekel. You are actually looking at two separate tracks 
of numbers. One number is just data. The number you are quoting 
with the $300 is just data centers. 

Mr. Mica. Okay. 

Mr. VanRoekel. There is a broader set of IT savings which have 
data center implications. 

Mr. Mica. So this is sort of a self-reporting and they are telling 
you that they have saved money by doing that. 
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Mr. VanRoekel. No. We actually track at the investment level 
through the lUIT report, and I would encourage you to check it 
you. 

Mr. Mica. So it wouldn’t be reflected in this. Then this $300 still 
stands, $300 million savings 0MB as of May? 

Mr. VanRoekel. In May, yes. In May, yes. 

Mr. Mica. So this is another billion. And where would you attrib- 
uted that billion coming from? 

Mr. VanRoekel. I am happy to share, with the permission of the 
Appropriations Committee, who we submit this report to, the re- 
port. 

Mr. Mica. Some data? 

I think it would be good for us to know. If you are making 
progress and it can be documented, we would like to know about 
it. 

Again, from the consolidation standpoint, we are somewhat still 
stuck in neutral, Mr. Powner? Actually, it looks like we are not 
only in neutral; it looks like we have gone in reverse because we 
actually have found more of these non-core centers than we antici- 
pated. So we are behind the eight ball a bit. 

Mr. Powner. On the data center consolidation, that now has 
been merged with PortfolioStat, but to be real clear on data center 
consolidation, there is to be 800 centers closed, more than 800 cen- 
ters closed by the end of this fiscal year, by September. 

Mr. Mica. What happened is we start out, even if we close the 
800, that would have been 800 out of 3,100, and now we are look- 
ing at 7,100 or more, because we are not sure exactly. So it doesn’t 
appear that we are making progress. If it was 800 of 3,000, that 
would be somewhat more significant. 

Mr. Powner. Mr. Chairman, I think there are fundamental ques- 
tions about how many we will ultimately close and what the sav- 
ings will be, and we agree that we need to optimize what remains, 
but still, with that large number of closures, there should be associ- 
ated savings with that. 

Mr. Mica. Well, again, it sounds like you have testified, too, that 
there is even more potential savings, so we would hope that can 
be, the problem seems to be, VanRoekel has great credentials for 
his position, coming from the private sector and observing sort of 
the Federal mess and trying to straighten it out, but we have tried 
several tools that don’t seem to be that effective. We had this data 
consolidation, whatever the FDCCI, and then we have gone to this 
Pro whatever it is, and it doesn’t appear that these tools are that 
effective. 

Okay, we are developing matrix. You said we are continuing to 
developing matrix to, again, get a handle on this or to move for- 
ward with realizing these savings and consolidation. But is this an 
evolution of the two or three sort of programs you have already set 
up? Are they an evolution? Explain what you are doing to get these 
agencies to maximize the potential for consolidation and savings. 

Mr. VanRoekel. I think the key is every day in the private sec- 
tor you think about what impact are you driving, what is the result 
you are trying to affect. It could be selling products; it would be 
moving the stock price; it could be creating value. And thinking 
about that impact in working your way back from that is key. 
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So what we hope for here is definitely cost-savings and closures. 
That is an ends, not a means. And the means to get to that is 
thinking about what applications am I running; how many email 
systems do I have; what kind of things am I deploying; what are 
the characteristics of the outcome I want to drive. So if you ask any 
CEO their advice, they will say measure what you care about, and 
what I care about is the optimization. 

Mr. Mica. That is the end results in providing the IT services, 
but when you have, okay, let’s go back to Powner is telling me, 
what did you testify, server use is 5 to 10 percent? 

Mr. Powner. Well, when we started the data center consolida- 
tion initiative, it was because average server utilization across the 
Federal Government was 5 to 15 percent. So that is a lot of unused 
capacity. 

Mr. Mica. Exactly. Exactly. That would be one of the sort of fun- 
damental things I have. Setting up servers, the energy they use, 
the space they use, the inefficiency of 5. Where are we now? 
VanRoekel, it seems to me like you would look at that to begin 
with. I mean, getting the mission done is good, but you have peo- 
ple, they can certainly do the mission with lots of servers and all 
of these centers, but somehow the core expense and the consolida- 
tion efficiency goes back to the equipment, the hardware and the 
utilization of software that we aren’t — Powner, do you continue to 
monitor this? Where are we at now with, say, the utilization of 
servers? 

Mr. Powner. We are not monitoring that now. We were moni- 
toring that at one time because that was stated in agency consoli- 
dation plans, which we don’t currently have visibility into that. I 
think a key question is this: The core centers that remain, so we 
are going to close several non-core centers. The core centers that 
remain, where are we at on utilization on those. That ought to be 
a key metric. 

I agree with Steve, and there are a lot of metrics on power usage, 
efficiency, and those types of things, but if we are attempting to 
solve a problem of low server utilization, the core ones that remain, 
did we fix the problem. And we are ready to go out and measure 
that once those core centers are up. 

Mr. Mica. But, to me, that would be sort of fundamental. You 
are probably not going to do away with the core centers, but better 
utilization. 

Mr. Powner. Absolutely. 

Mr. Mica. And if you are not doing that and you want to accom- 
plish a mission, you look at the alternative. If it isn’t using that 
core, going to cloud or some other more efficient thing. But the 
problem is you go back to the matrix. We have had a couple of 
plans to kind of get this thing going and to try to move the consoli- 
dation, better utilization of the assets that we have, but that 
hasn’t, apparently, worked. 

Now, we will probably be here in six months and haul everybody 
back, and we may get more discovery of non-core data centers and 
maybe a few more of those closed, but it doesn’t appear like we are 
really getting a good handle on a means to make this happen. 

And then you have McClure here, who comes from GSA. 
McClure, you guys haven’t set a very good example in your own op- 



76 


erations. You have closed only one, less than one percent. You have 
115 non-core data centers. What about yourself not operation? Any- 
thing to say on that? 

Mr. McClure. Well, I think that data that you are looking at 
was the second quarter reporting from GSA. Since then there has 
been a lot of movement. GSA owns, primarily, non-core data cen- 
ters, small data centers, and we were in the middle of collecting 
the date when that second quarter 

Mr. Mica. So what is the good news? 

Mr. McClure. Well, the good news is we expect to close 75 of 
our 116 non-core data centers. 

Mr. Mica. Expect to, but how many? 

Mr. McClure. Thirty-eight will be done by the end of fiscal year 
2013; another 37 in fiscal year 2014. 

Mr. Mica. So we will run from one to add 37 more is what you 
are telling us now. 

Okay. And, again, you have cited some of the things you are try- 
ing to do. Let me look at my notes here. You ever listen to WTOP 
in the morning? They have all these guys advertising that they can 
do this. That is the lighter side. I listen to WTOP in the morning 
and I swear they have 10 ads, by the time I am through shaving, 
on who can consolidate IT centers and how they do such a great 
job. It doesn’t sound like anyone is listening, though. 

But you are still developing tools to evaluate all of this and you 
have put some tool, the data center optimization. Explain that and 
how it works. 

Mr. McClure. Well, I think it gets at the heart of what Dave 
was saying and what Steve was saying, and what you are saying, 
Mr. Chairman. We have to have a data-driven decision-making 
process and transparency into that data. The GSA, our office has 
created a total cost of ownership model which would provide data 
into a lot of these areas that we are have been talking about this 
morning; power capacity, utilization. 

Mr. Mica. But you are laying out sort of the things that you 
could do; it is not things that you should or must do? 

Mr. McClure. No, no, this model exists. It is in the hands of all 
the agencies. It is an optimization planning tool that they can look 
at. 

Mr. Mica. Again, part of the solution would be to, and I have got- 
ten to this. I have run out of time, but is to make certain, maybe 
VanRoekel has the tools to do this. Maybe from a procurement 
standpoint you would dictate or mandate that such-and-such has to 
be achieved. VanRoekel has to go in and sort of force them. I have 
always said we give you budget authority, and they aren’t per- 
forming and you just, you know, you have to have some teeth in 
the process to get people to do things. 

But I will leave it at that. I will come back. I want to give others 
an opportunity. 

Mr. Pocan. 

Mr. Pocan. Thank you, Mr. Chairman. 

This is a question maybe for Mr. McClure. According to the GSA 
website, the goals of the EedRAMP program include increasing the 
confidence and security of cloud solutions and security assess- 



77 


ments. Under the process, cloud service providers must adhere to 
certain security requirements and undergo an independent audit. 

I am wondering a little bit about the confidence that agencies 
like DHS and DOD and NSA can have with information that is 
stored on the cloud, that it won’t be compromised in some way. 

Mr. McClure. It is a great question. I think if we follow the 
baseline security requirements that we have established in 
FedRAMP and we do the independent certifications by these third- 
party assessment organizations that know how to assess cloud se- 
curity, I think we will have much, much greater confidence that 
our data at all trust levels is really secure. I think FedRAMP is 
trying to instill in the Government a trust level that has not been 
there before, and to date we are finding it really does improve the 
confidence and trust of both the agencies and the providers that 
they are doing that. 

Mr. PocAN. And given all the controversy about cyber attacks 
and things, what confidence do we have that, as hackers are con- 
stantly revising how they are finding ways in, how confident are 
you that that FedRAMP process will provide enough flexibility that 
we can keep up with any evolving schemes or new technologies to 
try to break through? 

Mr. McClure. I think it will do it in two ways: number one, we 
are always going to be changing the FedRAMP security program. 
As the NIST security guidelines change, we incorporate that into 
the FedRAMP baseline, so it is always going to be up to speed with 
what NIST is recommending the Federal agencies do. 

Secondly, we are putting a lot of stock in the ability of these 
agencies to do continuous monitoring so that they have a real-time 
operational view of their security posture of themselves and their 
cloud providers. That is the best defense we can put in place, is 
having very robust, continuous monitoring. 

Mr. PocAN. And these audits, who is going to do the audits and 
what do they typically consist of? 

Mr. McClure. The audits that are done for FedRAMP certifi- 
cation are done by independent assessment organizations either off 
a list that we have put together, where companies have passed our 
accreditation that they actually have the capability to do the cloud 
assessments, or independent ones that exist in the marketplace. 
Based upon those audits, we can then review that in my program 
management office and determine whether there are any follow-up 
questions. Or the agencies can use them and feel much more con- 
fident that the audit has been done consistently, according to base- 
line standards, and is repeatable, can be reused across Govern- 
ment. 

Mr. PocAN. And the timeline for FedRAMP to be fully oper- 
ational? 

Mr. McClure. It is moving into fully operational status now. We 
have run it for a year in what we call an interim operating capa- 
bility. We didn’t want to roll this out Government-wide until, if you 
pardon the expression, kick the tires, so we wanted to make sure 
this worked. We wanted an opportunity to refine it for success, and 
we think we are ready now. 

Mr. PoCAN. Thank you, Mr. Chairman. I yield back the remain- 
der of my time. 
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Mr. Mica. I thank the gentleman. 

Mr. Meadows, the gentleman from North Carolina. 

Mr. Meadows. Thank you. I appreciate the insight. I must say 
that I am troubled by some of the things that I am hearing here. 

Mr. McClure, let me start with you. So, to date, you have closed 
one data center, is that correct? 

Mr. McClure. I will check as of today. I don’t know if it is one 
or more, but there are several that we are nearing the close. 

Mr. Meadows. My data says that you have closed one in three 
years. And you are going to now, according to your testimony, you 
are going to close 37 in two months? What happened to go from one 
in three years to 37 in the next two months? How do you plan to 
accomplish that? 

Mr. McClure. Well, I don’t operationally own the task myself, 
the CIO of GSA does. 

Mr. Meadows. So if it doesn’t happen you can blame them? 

Mr. McClure. I am not blaming, I am just stating a matter of 
fact. 

Mr. Meadows. Well, we need to know where does the buck stop. 
Does it stop with you or does it stop with GAO? 

Mr. McClure. It should stop with the head of the agency, as 
with all these matters. 

Mr. Meadows. So it stops with you. 

Mr. McClure. I am not the head of the agency; I am the head 
of an office that provides the tools that we talked about to help get 
this job done. 

Mr. Meadows. So if we bring you back in two months and 37 of 
them are not shut down, who should we hold accountable? 

Mr. McClure. Well, the CIO holds responsibility in each agency 
for doing the data center consolidation work and for estimating 
plan closures, so the CIO owns the issue. The head of the agency 
is ultimately responsible. So those are the two individuals at GSA 
that have their eyeballs on the situation. 

Mr. Meadows. So what happens if they don’t make the 37? 

Mr. McClure. I think you should ask for an explanation. 

Mr. Meadows. So Ms. Coleman would need to come here and say 
why she couldn’t get it done? 

Mr. McClure. I would recommend that, yes. 

Mr. Meadows. All right. 

Mr. McClure. I think that would be true, by the way, across the 
board for every agency. A lot of the responsibility here lies at the 
CIO and head of the agency level. So the same conversation could 
be repeated across multiple agencies. 

Mr. Meadows. So essentially we have a whole bunch of people 
that come and give testimony before Congress, but really don’t 
have the responsibility for implementing those things. So we have 
hearing after hearing after hearing and nothing gets done? Is that 
what happens? 

I mean, I am at a loss on how one got closed. I think you have 
three core centers, 115 non-core centers, and we have one closure 
in the last three years, and now, all of a sudden, we are going to 
ramp up. Why is that? I mean, who made that decision to ramp 
up and how is that going to happen? 
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Mr. McClure. Well, I think the thing to remember is that, 
again, we had a definition change. That is the reason why the 
number of data center number changes. 

Mr. Meadows. Okay, but we have heard from testimony, I think 
over here, that actually the number of data centers have increased. 
But they really haven’t, so they have stayed static. 

I think 0MB, according to your briefing, you knew as far back 
as June of 2012 that we actually had 6700 centers, and that has 
grown to 7100 now, is that correct? 

Mr. VanRoekel. Sir, I actually evolved and put more rigor be- 
hind the definition to expand the definition. 

Mr. Meadows. Of what a data center is? 

Mr. VanRoekel. Of what a data center is. What I didn’t want 
to do is have Federal agencies either splitting up big ones and put- 
ting them in small rooms or hiding computing resources, because 
you add up those small ones, you are going to get as much as a 
big one, and I want to track all of them. Our prior definition only 
tracked the very large. If we change the definition 

Mr. Meadows. So your prior definition of large ones 

Mr. VanRoekel. Was over 500 square feet, I believe. 

Mr. Meadows. Okay. And that was 6700? 

Mr. VanRoekel. Was the 3,000. 

Mr. Meadows. Is the 3,000 number that they originally reported. 

Mr. VanRoekel. So I came in and said I don’t want anything 
hidden, I don’t want resources in dark corners. 

Mr. Meadows. Okay, that is reasonable. 

Mr. VanRoekel. I expanded the definition to say we are going 
to go into the small ones too. That contributed, then, to the 

Mr. Meadows. Okay. So what you are saying is that expansion 
is really a function of changing the criteria of what we call a data 
center. 

Mr. VanRoekel. To be more comprehensive and derive better in- 
ventory. 

Mr. Meadows. All right, so let me pick up on one other line of 
questioning, then, because I think what we are saying is our server 
capacity right now, according to Mr. Powner, we are operating at 
5 to 15 percent. Would you agree with that? 

Mr. VanRoekel. I don’t have raw data, but that is probably an 
industry 

Mr. Meadows. So why are we continuing to buy new servers, 
then? And I am not talking about replacing existing servers. We 
are actually purchasing additional servers. So why are we doing 
that if we have excess capacity? 

Mr. VanRoekel. The way that technology grew up and the way 
that we built data centers very much follows what the private sec- 
tor did, which it was 

Mr. Meadows. Well, if I did this in the private sector I would 
go out of business. 

Mr. VanRoekel. Until about mid-2000, the private sector did 
this. 

Mr. Meadows. I understand. 

Mr. VanRoekel. Server utilization for corporate customers — I 
was part of the leadership to the server division of Microsoft — was 
7 percent utilization prior to this new technology coming onboard 
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called virtualization that allows you to put more stuff on physical 
hardware. You need new hardware to run that technology. There 
is new investment. 

Mr. Meadows. But that is what I am saying, this is not replace- 
ment of existing servers; these are actually additional servers, ac- 
cording to the data that I have. 

Is that correct, Mr. Powner? 

Mr. Powner. The increased inventory is existing, what currently 
exists at these agencies, where we are discovering more based on 
the new definition that Steve laid out. So 

Mr. Meadows. So this is just a definitional change, it is not an 
actual increase in the number? Are you all sure about that? 

Mr. Powner. I think it is both. I think it is both. Here is what 
happened. Initially we started off, the definition was 500 square 
feet or larger. Then we expanded the definition and things were 
smaller. Steve did the absolute right thing because there were a lot 
of opportunities to save by including these additional things. So the 
definitional thing resulted in an uptick. 

But I think over time, based on our audit work, because we go 
in and ask agencies what their inventories are, we see these inven- 
tories continuing to grow over time. So it is twofold, it is the in- 
crease, it is the change in definition, and it is also they are discov- 
ering more what they have. 

Mr. Meadows. All right. So let me go back and pick up on the 
national security. If we have 7100 data centers, from a security 
standpoint how do we manage that security aspect from the stand- 
point of cybersecurity, a number of things in terms of attack? Be- 
cause it seems like it would be the more concentrated it is, the 
easier it is to provide a higher level of security. So, as we grow that 
out, is there a matrix right now that you are looking at to try to 
say, well, optimum efficiency would be to get down to 2,000 serv- 
ers? I mean, do you have a number? 

Mr. VanRoekel. It is less about the raw, the number of data 
centers, of course, is important, as we are talking about today. 
Cybersecurity related to data centers is just a little bit different in 
the way you think about that. And the way we build our cyber ca- 
pabilities is grounded in FISMA, the Federal Information Security 
Management Act, and we use a process called CyberStat, much like 
PortfolioStat, that tracks key metrics, and effectively what you 
want to make sure you are doing is that when traffic comes and 
goes from these centers, that they are going through these trusted 
Internet connections and that we have capabilities there 

Mr. Meadows. But fewer data centers would make that an easier 
task or not? 

Mr. VanRoekel. I think it would make it an easier task, defi- 
nitely, and that is a byproduct of 

Mr. Meadows. So where do we need to be? If you had control 
over all the other agencies and you are the guy that is in charge 
and ultimately the buck stopped with you, how many data centers 
do we end up? What would you do if you were a private sector guy 
trying to make money here? What would you do? 

Mr. VanRoekel. Fewer is better and optimized is better. 

Mr. Meadows. How many fewer? 
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Mr. VanRoekel. It would depend on the size of the agency, the 
mission of the agency, what is the relationship of that. Homeland 
Security, for example, has defined three core data centers. 

Mr. Meadows. Sure. 

Mr. VanRoekel. I think that is a good target to think about. 
And these are highly optimized, they follow all the guidelines that 
we have put forth in this approach to say where we need to go. I 
can’t extrapolate for the whole of Government. 

Mr. Meadows. And that is fine, but so we don’t just have hear- 
ing after hearing, I would ask if you would go ahead and try to put 
together what the plan is so we know whether — one of the criti- 
cisms of your agency, and I understand this is a new role, is that 
you are not measuring, that you are not effectively measuring, and 
I think that that can be maybe accurate in some ways and inac- 
curate in others. I will give you that. What I would love to see is 
how do we know whether we are being successful or not, so really 
would love for you to follow up on that, have your staff follow up 
on that. 

The second part of this, and this is probably as critical, what can 
we do as Congress to give a real incentive for us to save money. 
I have hearing after hearing where we save billions and billions of 
dollars, but yet we ask for more and more money. So what I would 
love to do is to find a real way where you say, Mr. Meadows, if we 
did this, if you offered us this, we could assure that we could get 
$50 billion in savings or over the life, or whatever it is. 

But I am talking about real incentives where, hopefully in a bi- 
partisan way, we can come up with something that gives you incen- 
tive. I would love to hear that from each one of you, not in terms 
of answering that question, but as a follow-up, if you would submit 
that to us. 

Thank you so much. I yield back, Mr. Chairman. 

Mr. Mica. I thank the gentleman from North Carolina and recog- 
nize our ranking member, Mr. Connolly now. 

Mr. Connolly. Thank you, Mr. Chairman. 

Forgive me, Mr. VanRoekel and Mr. McClure, for not being here 
for your testimony, but I have been trying to catch up. I had to 
move an amendment on the Floor and the Republican manager ac- 
cepted my amendment. So I don’t know whether it means it was 
just awful and brilliant or whether apparently I wrote an amend- 
ment that was so weak that even for them it was acceptable. I 
don’t know, but I will take the gift. 

Mr. Powner, if I understood your testimony correctly, you, inter 
alia, said we seem to be sliding backwards in terms of certain 
metrics with respect to, for example, data center and Dashboard, 
is that correct? 

Mr. Powner. I think in terms of the Dashboard, yes, on the data 
centers what we want to do is we want to track savings. I think 
we want to know what the inventory is, transparency on what the 
inventory is, what the savings are, and then how we optimize what 
remains. And transparency around that is key. 

Mr. Connolly. Okay. I also thought I heard you say there is 
some concern that the Government doesn’t fully know what it has 
when it comes to data centers. 
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Mr. POWNER. Well, when we see the inventories growing as they 
have over time, you can just take the snapshots in time; it keeps 
growing, so there is still a concern have we still captured every- 
thing. 

Mr. Connolly. And I also thought I heard you say that you 
thought the FATAR legislation passed out of this committee and 
passed on the floor of the House would be actually helpful to the 
Government in trying to get its arms around this subject matter. 

Mr. PoWNER. On data center consolidation optimization, it would 
codify that in law, clearly. 

Mr. Connolly. Mr. VanRoekel, your reaction to those elements 
of Mr. Powner’s testimony? 

Mr. VanRoekel. As I mentioned earlier, I do agree that there is 
a level at which the inventory management, when you cast a net 
across the Federal Government, there will be things you probably 
aren’t finding just given the sheer size. I think our rigor around the 
definition and modifying that definition over time to capture more 
of what is out there has been the driving force behind the number 
increasing, less about sort of inventory management. But I do 
think there will be edge cases where we will have more come up 
in different cases. 

Mr. Connolly. Can I interrupt you there? I take that point, but 
if you look at GAO’s report agency-by-agency how you are doing in 
data center consolidation even before the announcement of an addi- 
tional 4,000, it is pretty slim pickings for most Federal agencies. 

Mr. VanRoekel. If you visit a data center and understand how 
a data center works, it is not literally walk up and pull the plug 
and say I am going to shut this thing down. And the incentive 
structure you want to establish here needs to be one where you 
drive to optimization, because if you lay a metric out and say close 
data centers, cut them by 30 percent, cut them by 40 percent off 
just a denominator of inventory, what you will have happen is Fed- 
eral agencies, in many cases, will literally take a forklift, pick up 
small data centers, move them to a larger room and plug them 
back in. 

Mr. Connolly. And that is called compliance. 

Mr. VanRoekel. And that is called compliance. So you have two 
next to each other and they remove the wall between them, thus 
reducing that by 50 percent. That doesn’t get where we want to go, 
which is to get that utilization up, get the optimization up, get the 
service out of that data center to increase in such a way that you 
drive better outcomes for the mission of that agency and for the 
American people. 

So the incentive structure has to match to the measurement in 
a way that I think needs to drive the behavior we want to see and 
the outcomes we want to drive. So the uncertain budget environ- 
ment we have been in for a while, CIO authorities, which the 
FATAR bill looks at that, and other driving factors contribute to 
this phenomenon of not being able to just shut one off. 

Mr. Connolly. I do want to be clear. The FATAR legislation is 
not sort of a Luddite approached to the subject matter; it actually 
does require tracking and it does have other measurements about 
utilization and so forth that are incorporated into the concept. So 
I think we kind of took your point. But I would also say to you that 
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the metrics of the number of data centers and the need to reduce 
them came out of this Administration. I mean, that wasn’t some- 
thing that ended up here; that was something that came out of the 
White House. 

Mr. VanRoekel. And we still stand behind that direction. 

Mr. Connolly. We kind of hope you do. We take your point, and 
we are not always good about nuance, but we are going to try to 
be responsive on a nuance way, the bottom line is efficiency, utili- 
zation. But we have to have some metric that says we have too 
many of these things, and that alone tells us we are inefficient; 
that tells us, you know, sort of there’s no place like home syn- 
drome: I know Steve has a better one, but kind of like ours right 
here, and we are not going to give it up willingly, and we are going 
to use every bureaucratic trick in the book to protect and preserve 
it, irrespective of utilization. Utilization, we can have Harry and 
Shirley go there twice a day instead of once a day and get up to 
utilization; it doesn’t really get to what we are trying to get at. 

And I was saying to the chairman, he shares my view that I 
think the fact that you are now also at 0MB gives us some hope 
that from a management point of view we can perhaps persuade 
people that there is a better way of doing this and it is win, win, 
win. We can save on energy, we can save on budgets, especially in 
a time of contracting budgets, and we can make ourselves more ef- 
fective. So we want to be supportive of that, but we are frustrated 
that the numbers are not particularly felicitous. And I hope you 
can understand that, from our point of view, that is to say. 

Mr. VanRoekel. Yes, I can definitely understand that. 

Mr. Connolly. Okay. The IT Dashboard, the Department of De- 
fense reports zero investments with significant concerns and has 
not updated the status of most of its investment over two years, 
and that more TechStat reviews obviously need to occur, as Mr. 
Powner said in his report. What are we doing about that? I mean, 
that is actually, to me, astounding. Here is the biggest expenditure 
of Federal dollars, here is the biggest investor of Federal dollars, 
here is the biggest client we have, from your point of view, and it 
hasn’t even essentially updated its Dashboard in two years. Huh. 
I guess we have been busy doing other things. 

Mr. VanRoekel. I think it speaks to a couple aspects. One is we 
don’t, in 0MB, in my office, track the self-reported status as the 
key indicator of performance on investments. It is a fool’s errand 
to track a self-reporter. You would never have a contractor self-re- 
port their results or things like that. So we go deeper than that 
and look at how often do they change schedules; where are they on 
budget, are they hitting budget; what is their time to delivery on 
services, all of these kinds of things. 

I have actually added features to the IT Dashboard in the last 
couple years that give me indications when agencies go in and do 
re-baselines, meaning they have changed their data in some funda- 
mental way. Those, to me, are the red flags you want to look at. 
And where we will lift up and say there is something going on 
there, where self-assessment will never do that for you. And I 
agree that it is laughable, to some degree, on DOD not reporting 
any core investments, but we know; we track and we know where 
those are. 
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The second part of it is CIO authorities. And I think looking at 
the authority of the CIO, the person whose picture is next to all 
those investments is Terry Takai. Terry Takai has very little influ- 
ence over most of the investments that you are looking at on that 
Dashboard and has very much an inability — you know, she is re- 
porting what she gets from the self-reported aspects of the people 
out in the periphery, and I think it speaks to a larger theme of 
something we need to look at in Government around what is the 
authority of the CIO or whose picture should be next to that. 

Mr. Connolly. Well, funny you should bring up that subject, Mr. 
VanRoekel. FATAR addresses that issue in terms of the stream- 
lining of CIOs in Federal agencies and the infusion of authority, re- 
sponsibility, accountability in a CIO, a principal CIO for each of the 
26 major agencies. And I think Mr. Powner, in previous testimony, 
has highlighted that as well. So I commend the bill again to you, 
because I think it tries to move us in that direction without a 
heavy hand. But it is trying to inculcate more flexibility for a chief 
CIO. It doesn’t abolish all other CIOs, but I would commend it to 
you that it is designed, again, to address the very thing you are 
talking about. 

Now, DOD, because of jurisdictional issues, is not directly ad- 
dressed, but sooner or later it will be, and we will be glad to work 
with the Administration to make that happen. 

Some questions have come up recently about energy savings per- 
formance contracts, and let me ask what is the role of 0MB in ap- 
proving such projects. 

Mr. VanRoekel. OMB doesn’t, accept for interpretation of policy 
or matters where procurements reach a certain threshold where we 
have a review board process that is part of our normal Office of 
Federal Procurement Policy work, review those and provide counsel 
to agencies; it is the agency’s decision to go forward and the Pro- 
curement Office to go forward with the procurement. 

Mr. Connolly. So OMB is not going to play any kind of direct 
role in the awarding of such contracts, the approval of such con- 
tracts, the extension of such contracts, or even just conceptually 
the general approbation of or disapproval of those as a tool. 

Mr. VanRoekel. We provide guidance in that context. 

Mr. Connolly. Okay. I thank you. 

And, Mr. McClure, when we had our field hearing there were 
concerns raised about GSA’s performance with respect to data cen- 
ter consolidation. You were not there to answer those questions, so 
I want to give you, as my last question before we have to vote, an 
opportunity. How is it going? I think after the hearing you did have 
some announcements, and that was good. It would have been nice 
to have them at the hearing. But the concern is that this is a sus- 
tained trajectory, not just a let’s please them and give them some- 
thing to report, and it kind of looked like the latter more than the 
former. So reassure us that that is not true, please. 

Mr. McClure. Well, I do want to reassure you. I think it might 
have the appearance of that, but, as I was explaining while you 
were gone, there was a lot of data collection going on that had not 
ended by the second quarter reporting period, which is the data 
that the committee had at that time. So, as a result, shortly after 
the hearing, with updated numbers, our situation looks much bet- 
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ter; 38 planned closures by the end of fiscal year 2013 and an addi- 
tional 37 in fiscal year 2014. 

Mr. Connolly. Can I interrupt you there, Mr. McClure, just to 
satisfy myself? The chairman was reminding me the report we had 
was you have done one. Now you have 37 more in the pipeline, but 
how could we have taken so long to just have one? 

Mr. McClure. Well, I will give you some explanation that re- 
volves around what Steve just said, and that is that CIOs in the 
Federal Government often don’t have complete control over all data 
centers in that department or agency. That was the case until May 
of this year, June of this year, in which Administrator Tangherlini 
consolidated CIO authority under a single CIO. So the ability to 
collect this data I think has been greatly enhanced with that kind 
of authority being vested in the CIO. 

Mr. Connolly. So, in other words, for example, had the FATAR 
bill been law, we might have been able to have happier numbers 
much sooner. 

Mr. McClure. I think it can help, because it has helped there. 

Mr. Connolly. Stop right there; you are doing fine. 

[Laughter.] 

Mr. Connolly. Okay, we have to go vote. This is part of a dia- 
logue. I certainly appreciate you being here. I hope we have con- 
veyed, through our frustrations we share on a bipartisan basis. We 
also, on a bipartisan basis, want to be partners. We want to help. 
This is an important part of Government that doesn’t get sufficient 
attention. But in terms of our future, the investments we make in 
technology are going to drive everything, not just something. And 
from megadata evaluation to cybersecurity attacks to wonderful 
ability to do great things more efficiently, you all have the keys in 
your hands to help us make that happen and we want you to be 
successful. 

So we want to try to help create an environment for success, so 
I hope you look at it in that spirit. Congress has an oversight role 
and we have to throw the flag down when we think something has 
gone wrong, but that is not the end game for us. And I can say my 
partner here, the chairman, Mr. Mica, has gone out of his way to 
try to create this subcommittee as a forum to be helpful and to be 
useful. So we look forward to working with you and thank you so 
much for being here today. 

Thank you, Mr. Chairman, for the hearing. 

Mr. Mica. Thank you, Mr. Connolly. 

I will re-echo his comments that we are trying to find some con- 
structive means of helping you move forward, both GSA has an im- 
portant role, certainly 0MB, and we want to talk some more, Mr. 
VanRoekel. I want to also see if the legislation we have pending 
provides you with the tools. You need some teeth. You are a nice 
guy. You came from the private sector and mission-oriented. 

I love all that, but the difference is in the private sector the peo- 
ple that are involved are business people who are bottom-line peo- 
ple; they are doing everything they can to bring the cost down, the 
efficiencies, maximize the assets that they have. Here you have a 
Federal agency; it is just more manna from the Treasury and they 
don’t have that same incentive. But we are going to figure out a 
way to give you all the tools you need to help us get the job done. 
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And thanks, Mr. Powner. Keep us posted as you reveal more of 
the findings that cause a bipartisan gasp in any panel of Congress 
like you did today. 

So, with that, I am going to ask that we leave the record open 
for two weeks. We have additional questions we didn’t get to. We 
want to have those answered in the record. So, without objection, 
so ordered. 

There being no further business before the Government Oper- 
ations Subcommittee, this hearing is adjourned. Thank you. 

[Whereupon, at 10:53 a.m., the subcommittee was adjourned.] 
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“Data Centers and the Cloud, Part II: The Federal Government’s Take on 
Optimizing New Information Technologies Opportunities to Save Taxpayers 

Money” 

Questions for the Record 


FedRAMP tthe Federal Risk and Authorization Management Programt is a standardized 
approach to cloud security certification that will save the government money, time, and 
staff by eliminating redundant individual agency security assessments. GSA claims it will 
save an estimated $200,000 per authorization. FedRAMP is a critical part of OMB cloud- 
first policy. Yet, we continue to hear complaints from the agencies and industry about the 
program's slow progress. 

The Committee is aware that, as of July 2013, eight cloud services providers are now- 
compliant with FedRAMP requirements. Five cloud providers have been granted 
government-wide provisional authority, including AT&T, Autonomic Resources, CGI 
Federal, Hewlett-Packard and Lockheed Martin. Three other cloud providers have been 
granted agency Authority to Operate, including Amazon Web Services’ GovCloud and US 
EastAVest offerings, each receiving authorization by the Health and Human Services 
Department. The Agriculture Department’s National Information Technology Center 
(secure government cloud provider) has been granted an authority to operate by the USDA 
Office of the CIO. 

The Committee continues to hear complaints from the agencies and industry about 
FedRAMP's slow progress. In fact, the program currently stands at just eight cloud 
services providers including the ones granted by individual agencies. Mr. VanRoekel 
stated in his response to the QFR following OGRs full committee's 1/23 bearing— 

"The FedRAMP program office at GSA anticipates that additional Provisional 
Authorizations will be forthcoming with continued authorizations during FY 2013." 

Ql: What is the current status of FedRAMP and how many cloud services providers do 
you anticipate to have under the government- wide FedRAMP by the end of FY2013 and 
FY2014? 

GSA Response: 

The FedRAMP Program Management Office (PMO) is currently working with ten different 
cloud services through the provisional authorization process with the FedRAMP Joint 
Authorization Board (JAB) while also maintaining the continuous monitoring programs for the 
five provisionally authorized cloud services. The FedRAMP PMO anticipates capacity to 
increase over the course of the next year to enable processing of about fifteen cloud services 
while maintaining the continuous monitoring activities of those services provisionally 
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authorized. Additionally, the FedRAMP PMO assists agencies across the Government, like the 
U.S. Department of Health and Human Serv'ices and U.S. Department of Agriculture, through 
their own security authorization processes to ensure the cloud services they use meet the 
FedRAMP requirements. 

As the June 2014 deadline approaches for agencies to comply with FedRAMP, the FedRAMP 
PMO anticipates an increase in agency authorizations along with the JAB provisional 
authorizations that meet the FedRAMP requirements. The FedRAMP PMO is assisting the 
Office of Management and Budget (OMB) to verify agency compliance through PortfolioStat 
reporting and reviews. Additionally, the FedRAMP PMO continues outreach to Federal agencies 
to assist with leveraging the current provisional authorizations. 

The FedRAMP PMO anticipates having another three sendees provisionally authorized by the 
JAB through the end of the FY 201 3, for a total of eight services through the JAB. Additionally, 
the FedRAMP PMO anticipates having another twelve provisional authorizations by the end of 
2014, for a total of twenty services through the JAB. 

Q2: Do you believe the FedRAMP process will deliver the cost savings predicted? 

GSA Response: 

Yes, Preliminary results from agencies leveraging FedRAMP authorizations show that agencies 
are attaining cost avoidance of more than $200,000 per authorization leveraged. 

The System for Award Management tSAM) is an E-Gov initiative aims to integrate 10 
different legacy acquisition systems into a single shared system - streamlining processes, 
eliminating redundant data, and saving taxpayer money. Late last fiscal year (9/2012), the 
initial launch of this system failed. The Committee is aware that OMB and GSA (SAM's 
program management organization) has since held TechStat reviews and restructured the 
program. 

Q3: Please provide a short chronology (month and year) outlining the initiative’s 
inception, deployment, and efforts made by the new leadership; 

GSA Response: 

System for Award Management (SAM) 

High Level Chronology 

(as provided in July 2013 to the House Committee on Government Oversight and Reform) 

Jul 29, 2012 SAM Go-live - Early challenges in system stability 

Aug 13, 2012 First day SAM was operational continuously for 24 hours for reps & certs 

(legacy Online Representations and Certifications Application (ORCA)) 
and registrations (legacy Central Contractor Registration (CCR) database 
/Federal Agency Registration (FedReg) database) 
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Aug 21, 2012 

Oct 22. 2012 

Nov 21, 2012 

Nov 27-Dec 10 
Dec 12, 2012 
January 2013 

Mar 8, 2013 

May 23,2013 
June 26, 2013 

Jul 12, 2013 
Systems Releases 

Outreach/Training 


Department of Defense (DoD) issues class action de\ iation for vendor 
registration in SAM in order to issue awards 

Administrator Tangherlini announces change in management of 
SAM/Integrated Award Environment (lAE) to a Federal Acquisition 
Seiwice (FAS)/ Office of Chief Information Officer (CIO) partnership 

Exclusions functionality (Excluded Parties List System (EPLS)) 
operational in SAM (Legacy contract support ended January 2013) - Early 
stability challenges with search features 

GSA re-worked SAM search functionality and stabilized operations 
DoD ends Class Action Deviation - SAM 

GSA initiated the analysis of alternatives to establish the long-term 
strategy for the lAE portfolio modernization 

Security Vulnerability detected - patch applied immediately, vulnerable 
users contacted, at-risk population offered with credit monitoring. GSA 
re-worked the SAM security framework over the coming weeks for 
permanent resolution 

Draft alternatives analysis presented to agency stakeholders and 0MB 
concurrence received 

608 notification letter sent to the Subcommittee on Financial Services and 
General Government Committee on Appropriations and the House and 
Senate Committees on Appropriations notifying change in management 
strucmre and funding sources supporting the lAE program 

Launch of redesigned Federal Service Desk website 

Scheduled Systems releases December 2012 and January, February, April, 
May, June, and July of 2013 - corrected over 4,000 defects and usability 
issues, and incorporating Federal policy requirements and improved 
functionality. 

Hosted six live public webinars for approximately 5,000 attendees 
regarding: Migrating from CCR to SAM for companies. Grantee Users of 
SAM, and SAM for Government Users 


Q4: Please provide estimated dollars spent on SAM thus far and the current estimate for 
the planned approach; 

GSA Response: 
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Estimated dollars spent on SAM thus far : As GSA works to stabilize SAM from its initial July 
2012 launch, continued consolidation of systems is frozen and key processes remain within 
legacy applications. The current SAM application contains functionality of the three legacy 
systems, CCR, ORC.A., and EPLS, and has cost S53 million to develop and maintain from its 
inception in FY 2010 through June 30. 2013. 

Estimated cost for planned approach : GSA met with 0MB at a TechStat and did work to 
establish a path foinvard. Once the final sequencing of milestones has been established, coupled 
with acquisition strategies, the long-term estimated costs of the overall program will be better 
understood. GSA feels confident that the overall cost of the program, as well as our approach 
moving forward, will offer the best overall value to the taxpayers. Our intention is that the 
proposed approach moving forward will lower the life-cycle costs of the program as compared to 
the costs incurred for simply operating the existing legacy systems indefinitely. 

Q5: The Committee understands that the GSA CIO was not involved in the SAM program 
until after OMB held a TechStat and the program was reorganized. Please explain why the 
CIO was not involved in the development of a critical IT system that is used by ALL 
agencies. Please provide the current status, including program management organization 
structure and the names of the individuals responsible for the success of the program going 
forward. 

GSA Response: 

When the SAM system was launched and the program flaws became evident, it was apparent that 
much greater IT leadership and CIO involvement was necessary, in addition to the ACE 
governance. In October 2012, the GSA Administrator transferred the technical oversight of the 
SAM/IAE program to GSA’s CIO so that the technical flaws in the system could be identified 
and rectified, the system could be stabilized, and a long-term strategy could be established for 
the lAE. 

Building on the lessons learned from the SAM/IAE program, the GSA Administrator also 
conducted a top to bottom review of the GSA IT organization, and empowered the GSA CIO to 
undertake a consolidation program, bringing together all IT programs, projects and investments, 
under the direct oversight of the GSA CIO. This consolidation process is well underway, and 
several teams are working to bring together the personnel, processes, resources, contracts, and 
budgets into one, cohesive IT organization. Under this new model, the GSA CIO will be directly 
accountable and empowered to oversee all GSA IT investments, projects, and initiatives. 

Software Acquisition . The Federal Government uses a huge number of copies of COTS 
software. When people move or change their computers, some of these licenses become 
dormant and become what is often called 'shelf-ware.' Some say we have numerous such 
shelf-wares licenses, but we do not know for sure because agencies do not have a 
comprehensive inventory of their IT assets; despite the statutory requirement under the 
Clinger-Cohen Act for IT inventory. Moreover, even if an agency wants to utilize such 
shelf-ware or excess software licenses, they are often prohibited under the user-license 
agreement from transferring it to the other federal agencies. The Committee is aware that 
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the UK Government is structuring its software license agreements so that the entire UK 
Government is one user. 

Q6: In your response to the QFR following OGR full committee's 1/23 hearing, you 
indicated— 

"OMB has followed the work of the UK closely in regards to COTS softw are 
purchases and the move to a single user model. The approach is quite interesting 
and there are a number of initiatives that are helping the UK better purchase at 
scale and reduce the number of duplicative contracts and licenses." 

Please share your findings regarding possible U.S. adoption of the successful UK approach. 

GSA Response: 

Please see answer provided by the Office of Management and Budget. 

Q7: How do you think the government can better manage its software user licenses so that 
there are no software licenses we purchase but do not use? 

GSA Response: 

Please see answer provided by the Office of Management and Budget. 

Cloud First Initiatives . As part of the administration's cloud-first policy, each agency is 
required to Identify at least three legacy systems that could be replaced by cloud solutions. 

Q8: Please provide the list and status of the major cloud migration initiatives in the 
Federal Government. 

GSA Response: 

Please see answer provided by the Office of Management and Budget. 

PortfolioStat . Initiated in March, 2012, the OMB PortfolioStat initiative is a tool that 
agencies use to make decisions on eliminating duplication and moving to shared solutions 
in order to maximize the return on IT investments across the enterprise. Through the 
PortfolioStat process, agencies are expected to develop a clearer picture of where 
duplication exists across their respective bureaus and components. This analysis should 
inform the budget process and help agency Deputy’ Secretaries eliminate waste and 
duplication within the IT portfolio. OMB projects PortfolioStat will save $2.5B. 

Q9: How many PortfolioStats have been held and with which agencies? 

GSA Response: 
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Please see answer provided by the Office of Management and Budget. 

QIO: Why was the previous PortfolioStat sasings goal of S2.5B not resised to reflect the 
merger of FDCCI into PortfolioStat? Considering the S3B sarings goal for FDCCl, 
shouldn't the new combined savings be $5.5B? 

GSA Response; 

Please see answer provided by the Office of Management and Budget. 

Qll: We’ve heard from GAO today that CIO authority is an issue with implementing 
PortfolioStat. What actions are you taking to address CIO authority? 

GSA Response: 

Please see answer provided by the Office of Management and Budget. 

Q12: Will data center consolidation lose focus if it is merged under PortfolioStat? 

GSA Response: 

Please see answer provided by the Office of Management and Budget. 

TechStat Accountability Sessions tTechStatsI . which are evidence-based reviews of each 
investment aimed at turning around or stopping troubled investments. In December 2010, 
OMB stated that these sessions resulted in $3 billion in reduced life-cycle costs and 
subsequently incorporated the TechStat model into its 25-point plan for reforming Federal 
IT management. 

OMB is holding less number of TechStats and overly relying on each agency. OMB held 59 
TechStats in 2010, 5 in 2011, and at least 6 in 2012. GAO reported that OMB-Ied 
TechStats represented only 18.5% of the troubled investments. For the 4 selected agencies 
GAO reviewed, the number of TechStats represented 33% of the investments that have a 
medium or high-risk rating. 

Q13: GAO reported that OMB-Ied TechStats represented only 18.5% of the troubled 
investments. How many OMB-Ied TechStat sessions were held in 2012 and 2013? 

Shouldn't 100% of the troubled investments be reviewed? 

GSA Response; 

Please see answer provided by the Office of Management and Budget. 

Q14: It is the Committee's understanding that TechStat was created, in part, because 
agency CIOs were not doing appropriate reviews of their IT investments. Yet 3 years later 
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OMB seems to be returning back to relsing upon agency CIOs. Will OMB stay engaged in 
TechStats? 

GS.4 Response; 

Please see answer provided by the Office of Management and Budget. 

Q15: What programs are on your TechStat radar screen? Specifically, what programs 
have you recently reviewed and what programs are on your schedule to review? How 
many TechStats does OMB plan to hold in FY2013 and FY2014? 

GSA Response: 

Please see answer provided by the Office of Management and Budget. 

IT Acquisition Workforce . Between fiscal years 2002 and 2012, acquisition spending by the 
Federal Government expanded by 95 percent, from $264 billion to roughly SS14 billion. 
While contract spending has risen dramatically, the number of acquisition professionals 
did not keep pace. Even more troubling, a significant portion of the current acquisition 
workforce will be eligible to retire over the next decade. 

Q16: Do you believe that the government’s acquisition workforce is adequate, in terms of 
size, experience, and expertise, to carry out the activities required for effective use of 
strategic sourcing, transition to the cloud, and shared services for Information 
Technology? 

GSA Response; 

The acquisition workforce (comprising contracting professionals, contracting officer's 
representatives, and program/project managers) has grown modestly over the last several years. 
OMB is encouraging agencies to retain these critical members of the Federal workforce in this 
tight budgetary environment because they can help agencies save money for mission critical 
support. Investment in our acquisition workforce is critical to ensure we have the necessary 
capabilities to execute agency missions. 

For nearly 30 years, OMB has parmered with GSA to operate the Federal Acquisition Institute 
(FAI) in order to train and develop a professional and capable acquisition workforce. GSA 
works closely with OMB who leads agencies in an acquisition workforce planning process each 
year to ensure agencies understand their acquisition workforce and plan their training and 
development. Both GSA and OMB are committed to ensuring the acquisition workforce is 
adequate for executing IT acquisitions. FAI currently leads the Program/Project Managers 
(P/PM) Functional Advisory Board and has recommended that IT competencies be incorporated 
into the P/PM certification process for IT Program Managers, 

Forty percent of the civilian agency 1 1 02 workforce is able to retire in the next five years. 
Another third have fewer than five years of experience. GSA works with OMB and the civilian 
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agencies every day to ensure the workforce is recruited, trained, developed, and retained to 
deliver the best value for taxpayer dollars. 

The U.S. Office of Personnel Management (OPM) and the Chief Human Capital Officers 
Council have designated acquisition one of the five Government-wide mission critical 
occupations that are strategic priorities for skills gap closure, OPM is partnering with the 
Federal Acquisition Institute (FAI) and Defen.se Acquisition University (DAU) to increase the 
percentage of the acquisition workforce that is certified to deliver effective support for agency 
contracting operations. Progress against this goal is reported on www.performance.gov as one of 
the President's Cross Agency Priority (CAP) Goals. 

Contract duplication (i.e., many contracts for the same or similar services across the 
federal enterprise), especially in IT, is a major challenge facing the Federal procurement 
system. It Increases costs for government and industry, costs that are ultimately borne by 
the taxpayer. Contract duplication increases bid and proposal, administration and 
overhead costs for all. 

Q17: Duplicative cloud contracts are being established by various agencies for 
requirements such as infrastructure or cloud-brokerage services (e.g., GSA, DOI, DISA for 
infrastructure-as-a-scrvice), wasting government & industry resources. What can be done 
about reducing the amount of duplication in contracting vehicles available to Federal 
agencies? 

GSA Response: 

Because agencies often have complex and tmique requirements, ordering procedures, service 
level agreements, and financial systems, the use of our existing cloud Blanket Purchase 
Agreement (BPA) is proving difficult for some, leading them to enter into their own contracts. 

In addition, many agencies opted to move their e-mail to the cloud prior to GSA awarding the 
Email as a Service BPA. What GSA has been finding is that we have to pay close attention to 
creating extremely flexible acquisition vehicles that incoiporate carefully gathered and 
implemented lessons learned. 

Regarding promoting the use of govemmentwide contracts as opposed to the proliferation of 
agency-specific vehicles, we suggest greater education of contracting officers as to the 
availability and pros and cons of using these contracts. In addition, we must eliminate agency 
barriers preventing the greater use of external contracts. For example, one agency requires their 
contracting officers to prepare a Determination and Findings when using external contracts. This 
requirement discourages busy contracting officers from using govemmentwide contracts. 

We suggest the review of Multiple- Award Contracts and govemmentwide contracts, and 
increased semtiny over the creation of single agency contract vehicles. The proliferation of 
single agency contract vehicles dilutes the government's buying power. Aggregated buying 
power can be leveraged through the use of GSA Govemmentwide Acquisition Contracts and 
other pre-competed GSA contract vehicles. In addition, the use of GSA's pre-competed contract 
vehicles can shorten the procurement cycle. In an agency mission-centric culture, it is 
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characteristic that an agency program ofEce'requiring activity will seek and demand the shortest 
and quickest road to accomplish its mission. The contracting activity for single agency vehicles 
generally takes one to two years to award. 

Government duplication of already existing software capabilities The Committee is aware 
of numerous instances where the government has decided to “make” or develop its ow n 
software systems, despite the ready availability of commercially viable products. 

• For example, GSA has determined to build a government reverse auction platform, 
despite the availability of commercial reverse auction software packages. 

• OPM has developed HR software, which it is offering to other federal agencies, 
despite the availability of mature HR software packages in the private sector. 

• OMB, in its recent policy memorandum lVI-13-08, appears to be focused upon 
government development of financial management systems, despite the ready 
availability of commercial alternatives. 

Q18: Why did GSA decide to build its own internal reverse auction tool 
(ReverseAuctions.gsa.gov) (“RA platform”) rather than engage existing commercially 
available solutions? 

GSA Response: 

GSA conducted a basic make or buy decision considering the cost of internal development 
(making) versus the cost of purchasing commercial offerings (buying). Although commercial 
fee models varied, the overall cost to the government was determined to be lower if GSA 
developed an offering in-house. In-house development costs were low because the GSA’s 
Reverse Auction Platform is built on existing GSA IT infrastructure and leverages GSA eBuy 
and GSAAuctions.gov software and expertise. 

a. What was the cost to GSA of that initial development effort? 

The initial development effort cost about $600,000 because we were able to redeploy 
existing GSA infrastructure for a modified purpose. 

b. Did GSA personnel access other reverse auction provider websites or software for 
purposes of, or related to, researching, designing or building the RA platform? 

As part of market research, GSA reviewed a variety of publicly available websites and 
other information related to electronic auction and reverse auction concepts. GSA 
contracts and BPAs are also available on a commercial reverse auction website. 

c. What are the ongoing annual costs of maintaining the system and continuing to 
develop system enhancements to the RA platform? 
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As deployed today, the annual maintenance costs are approximately $300,000. On the 
basis of customer feedback and customer usage of the platform and enhancements, an 
additional S3 million in development is planned for FY 2014, inclusive of maintenance 
for the system as it exists today. Once complete, the on-going maintenance costs of the 
system are expected to be approximately $1 million per year. 

d. What cost/bcnefit analysis did GSA conduct prior to contracting out the design and 
development of the RA platform? 

It should be noted that the GSA Reverse Auction Platform is a derivative of two existing 
GSA web platforms: GSA eBuy and GSAAuctions. Government full time equivalent 
employees and contractor resources were used to modify existing GSA technology to 
perform a new fimction. 

On the basis of market research, GSA found the current reverse auction market is 
approximately $ 1 to 2 billion in auction value per year. Considering commercial fees 
range from 1 to 3 percent of the auction value, GSA estimates the government spends 
between $10 million ($1 billion times 1 percent) and $60 million (2 billion times 3 
percent) per year on reverse auction serv'ices. The potential savings, low cost, and low 
risk associated with the reuse of existing GSA technology led to the decision to create an 
in-house system. 

Secondary “soft benefits” were also considered. Specifically, the ability to collect 
transaction-level pricing data is a key feature that will help drive better buying across 
government. Additionally, the GSA Reverse Auction Platform is a value-added feature 
of the GSA Multiple Award Schedules program and other GSA contracts. Making GSA 
contracts more valuable will reduce the need for other Agencies to award similar 
contracts. 

Q19: GSA has clearly indicated that its RA platform is competing with commercial 
platforms, highlighting “No Additional Fees” as a management benefit in its overview slide 
deck. What are GSA’s long-term goals with respect to its RA platform’s effect on 
commercial providers? 

GSA Response: 

It is the mission of GSA to “deliver the best value in real estate, acquisition, and technology 
services to government and the American people.” Providing a Reverse Auction Platform within 
our existing fee structure increases GSA’s value to customers, and therefore, is consistent with 
the misvsion of GSA. GSA’s long-term goal is to fulfill our mission. Commercial providers are 
considered in the context of the “make or buy decision” GSA conducted when determining 
which approach would be more valuable to government and the American people. 

Q20: Does OMB or the CIO Council review government initiatives to develop government 
IT solutions when commercial alternatives are available? Does the government utilize any 
form of “make/buy” analysis? 
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GSA Response: 

Please see answer provided by the Office of Management and Budget. 

Q21: Under what circumstances is the government better suited to develop and deploy 
Internal IT systems than to acquire these requirements form the commercial market? 

Whether private sector or government, the decision to in-source or to outsource the development 
and deployment of IT systems is a complex one. As needs for systems are identified, a rather 
structured decision process is called for in order to consider the many factors that will constitute 
the optimal approach and assure results that adequately meet the agency’s requirements. A 
critical success factor independent of deciding whether to build or buy is identifying the right 
mix of contractors and Federal employees for effective support of the system throughout its life 
cycle, and ensuring that project management and contract oversight reflect sufficient expertise to 
validate that commercial work products and performance meet contract requirements and 
standards, scheduled milestones, and budget constraints over the course of the system/application 
lifecycle. 
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